10

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication?

Assuming that 99% of the time that when you enter a password you do so on your own device, e.g. machine less likely to have key loggers on it (not some public library or cafe machine). What in this case is the point in having a two step authentication system other than peace of mind?

I can understand having 2 Factor Authentication to a password manager as you are repeatedly entering this password and it effectively contains the keys to everything else but for everything else why bother?

If I'm missing something here please tell me.

Improve this question
4
  • Even if you eliminate the possibility of your machine getting compromised, the website you regularly access itself might get hacked and leak you password. Without 2FA the hacker will be able to access your data.
    – Ulkoma
    Mar 10, 2015 at 16:18
  • A 20-25 character password which uses special characters along with digits has an entropy of over 100 bits. Meaning, it would take significantly longer than my lifetime to crack by a supercomputer.
    – Dave
    Mar 10, 2015 at 16:23
  • 3
    The complexity of the password won't help if the website was using a bad hashing algorithm of even worse: have the passwords stored in plain text. Security is like marriage takes two to tango. You can't assume the website's developers to be as careful and smart as you are.
    – Ulkoma
    Mar 10, 2015 at 16:27
  • That is a good point. But if they compromised the site than they could have very well compromised the secret keys to your time based one time password.
    – Dave
    Mar 10, 2015 at 17:09

2 Answers 2

Reset to default
16

There are a few benefits that persist in 2FA:

  • A keylogger can't make use of my 2FA passwords for later.
  • I can't share my 2FA with somebody on an ongoing basis.
  • I'm more likely to know my 2FA credentials are compromised (e.g., because my token is missing) than somebody simply copying my sticky note hidden in my wallet.
  • Somebody who phishes you will be have a limited window during which 2FA will be useful for them and it won't be ongoing.

Controlling the password is usually weaker than the password itself, and that makes 2FA very helpful even with very strong passwords.

Improve this answer
1
  • 2
    Also note that two-factor authentication means that if one of the factors gets compromised, the attacker still cannot get access. The strong password is likely to be saved in a password manager, which may be compromised (this is not as unlikely as it may sound, read the article). Having two-factor authentication will prevent the attacker from getting in without having compromised the second factor as well, which makes the attack significantly harder.
    – Wietze
    Jan 5, 2016 at 22:23
1

It is all about tolerance to risk. As you stated, a sufficiently strong password (and assuming no shortcomings on application of security, etc... which is a large leap of faith) means that cracking could take an unreasonably long amount of time (today at least). The question is how much risk are you willing to take? When we are talking about digital security then it is a matter of acceptable risk. If we could perfectly predict and say 'this password would take 3.7 years to crack', and that is acceptable to you, then that is secure enough. How about if adding 2FA changes that to 15 years to crack... would that make it more worthwhile? Or if we say, use this shorter password (not sure why you would do that... just brainstorming) and use 2FA and you still increase the crack time to 10 years, is that better? Or you have a website that you have no personal data in and you set a password that would take 3 weeks to crack... but if someone cracks it all they get is access to your site comments, do you care?

It is all give and take - convenience vs security.

My vote... go the 2FA route. Same reason I prefer to use S/Mime and TLS instead of just one or the other. If I can send encrypted content over a secure pipe, why wouldn't I add the security :)

Improve this answer
1
  • This would have been a decent answer worth an upvote if it hadn't completely contradicted itself in the last two lines, essentially discarding everything written before it. The first part of the answer - advocating for security decisions based on threat modelling - is perfectly logical. If I decide 3.7 years by current hardware is currently enough for a given site then it's enough, and there is absolutely no additional benefit to me to make it 15 years. Likewise for a throwaway password on a site with nothing of value on it, I'll reverse your question and ask... why would I add the security?
    – Hashim Aziz
    Jul 1, 2021 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .