0

I'm thinking of adding my website an option to login with just 2FA's second factor instead of just password. How safe would it be? I'm thinking of TOTP as 2FA method. Considering it isn't a big or important website, would it be safe?

marked as duplicate by user10211, Mark, Jeff Ferland Jul 12 '15 at 9:08

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 3
    You have to define "safe". – schroeder Jul 12 '15 at 2:18
  • I second @schroeder, define your threat and your definition of 'safe' without that, I feel this question is far too broad and subjective... – Matthew Peters Jul 12 '15 at 5:39
2

The obvious problem with this is the same problem with just using a password: as soon as someone has that, they have all the access they need. Assuming you'd use your phone, then if your phone was stolen, then that person can log in.

If you feel that the risks of using this method is acceptable, then it's acceptable. But you have to understand the weaknesses of the approach and accept them as part of the deal.

Let's put it another way in an extreme case: is it "safe" (you haven't defined that) to use a password of "123456"? Sure, it does keep people out of your account, until someone tries to guess your password and tries this very, very common password. Your account is "safe" from people who will not try to guess your password (but unsafe against those who do).

Is using a super-complex random password of 30 characters "safe"? Sure, it is now safe against those who would try to guess your password, but unsafe against those who would try a keylogger, or a password database that stores everything in plaintext, or a super-computer dedicated to cracking your password.

Each layer of complexity increases "safety" and secures your account against certain groups of threats. By only using 1 factor, you reduce the complexity and reduce the number of groups that you are securing against, but perhaps that groups that remain are sufficient for your needs.

  • I like this answer because it defines the ubiquitous 'safe' pretty well. I do want to point out that 'complexity' itself should never be confused with randomness which is the only thing that truly improves security (in my opinion). – Matthew Peters Jul 12 '15 at 4:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.