When designing a password reset process:

  1. Is an email address or an assigned username a valid piece of information (identifier) to ask for in two factor authentication?

  2. How does two factor authentication work for password resets in general? wouldn't asking more information from the user be an overkill when they have already forgotten their password?

  3. Is sending a reset code via mobile coupled with a unique identifier qualify as two factor authentication?

1 Answer 1


Two-factor or multi factor authentication is based on three possible forms of authentication:

  • Something you know which is considered secret (password)
  • Something you have (token, SMS token, card,...)
  • Something you are (biometrics)

If either two of these three are combined, you can speak of two-factor authentication. Saying two things you know (such as two passwords or username and password) IS NOT two factor authentication.

  1. You can use as an identifier but you cannot use it as the secret (if you plan to use it as the "password").
  2. Password resets will depend on the procedure in place. It can be the same as with a password, you just get a reset link in your email. This doesn't mean the second factor is altered! The password should preferably not be changed based on another factor of authentication (especially applicable in case of something you have in case of theft).
  3. Yes, but you should ensure that the token is only limited for a certain period.
  • thanks @lucas. Its an added burden on the user when we ask them for a secret piece of information when they have forgotten their password. but i understand the logic now. perhaps a 4 digit pin is more memorable than a password and we can then send a reset code to a verified mobile number.
    – Okavango
    Dec 11, 2014 at 13:00
  • That burden does secure the request. If you're going to use something just about anyone can find out about a person then it's a very weak control. Dec 11, 2014 at 13:05
  • Agreed! i think the best approach is to think about something that will not frustrate users to much but still ensures that we have a robust control. heard a quite a great deal of talk around keystroke dynamics recently so i am exploring my options.
    – Okavango
    Dec 11, 2014 at 13:09
  • 2
    Random question. Would requiring someone to log in from a certain location make it two-factor? Dec 11, 2014 at 15:26
  • 1
    Well in essence that's what most companies do, I wouldn't really call it a factor because you can't pinpoint it to a specific individual. But for instance getting access to a network through windows (with just a password) is often done. To get access remotely you often require a second factor such as a token to first access the vpn. Dec 11, 2014 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .