Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Google Authenticator uses static security key to generate time-based one-time-passwords.

This makes security key to be equivalent (in term of usage) to usual password.

As two passwords are equivalent to a single longer one, why security key counts as another authorization factor?

share|improve this question
I wonder if I should've asked this on programmers.stackexchange.com... – Basilevs Sep 4 '12 at 6:20
Information Security is probably a better choice for this question. – Al E. Sep 4 '12 at 12:38

First, I don't really know if Google Authenticator works with static security keys, but if they do, such a key is probably a lot longer than your usual password would be. EDIT: I can't find an example of suck a security key, I have to turn 2-factor auth off and on to get a new one, but @Basilevs suggests that they are only 10 characters long.

Second, it's only stored on your mobile phone, so no internet connection that can be intercepted. Only someone with access (count in malware ofc) to your phone can access the one-time-passwords.

Third, when your phone is lost or stolen, you can easily block that phone and create a new security key to use for your new phone.

Last but not least, I'm glad that you ask, since I recently found out myself that Google 2-factor authentication isn't so two-factor as it claims it is. In fact, when you activate 2-factor authentication, you get a pseudo 2-factor login, but what you really get is a still-1-factor login moved from your password to your phone's security code.

How so? When you click the Forgot Password? link, all that Google requires you to give for choosing a new password is your phone's one-time-password! So in fact, your password doesn't matter anymore at all, anyone with your phone has access to your account!

share|improve this answer
That last bit isn't true since forgot password also requires access to the secondary email address. So, there's still a too step auth process. – Joel H Sep 6 '12 at 14:57
I thought you could either send your secondary e-mail a password reset link or set a new secondary e-mail by entering a phone code, but I can be mistaken. – Steven Roose Sep 6 '12 at 19:35
True, but that's still second factor. – Joel H Nov 26 '12 at 15:36
It's a second factor but it does not (necessarily) add a new factor to the process, it adds a different option. It's still one-factor but with two choices. – Steven Roose Nov 29 '12 at 22:40

My understanding is that after you've set it up, your phone or whatever device you are running the authenticator app on becomes your physical factor. No matter how it was set up, and this will depend on the implementation of the system, you now have a physical 'token', so in terms of security, after you enter your password you must have that token.

If you forget either, you can't get in, at least not without a bit of hassle, and so it's more secure than just having a password in your head, or worse still, stuck on a Post-IT note.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.