Google Authenticator uses static security key to generate time-based one-time-passwords.

This makes security key to be equivalent (in term of usage) to usual password.

As two passwords are equivalent to a single longer one, why security key counts as another authorization factor?

  • I wonder if I should've asked this on programmers.stackexchange.com...
    – Basilevs
    Commented Sep 4, 2012 at 6:20
  • Information Security is probably a better choice for this question.
    – ale
    Commented Sep 4, 2012 at 12:38

3 Answers 3


First, I don't really know if Google Authenticator works with static security keys, but if they do, such a key is probably a lot longer than your usual password would be. EDIT: I can't find an example of suck a security key, I have to turn 2-factor auth off and on to get a new one, but @Basilevs suggests that they are only 10 characters long.

Second, it's only stored on your mobile phone, so no internet connection that can be intercepted. Only someone with access (count in malware ofc) to your phone can access the one-time-passwords.

Third, when your phone is lost or stolen, you can easily block that phone and create a new security key to use for your new phone.

Last but not least, I'm glad that you ask, since I recently found out myself that Google 2-factor authentication isn't so two-factor as it claims it is. In fact, when you activate 2-factor authentication, you get a pseudo 2-factor login, but what you really get is a still-1-factor login moved from your password to your phone's security code.

How so? When you click the Forgot Password? link, all that Google requires you to give for choosing a new password is your phone's one-time-password! So in fact, your password doesn't matter anymore at all, anyone with your phone has access to your account!

  • That last bit isn't true since forgot password also requires access to the secondary email address. So, there's still a too step auth process.
    – Joel H
    Commented Sep 6, 2012 at 14:57
  • I thought you could either send your secondary e-mail a password reset link or set a new secondary e-mail by entering a phone code, but I can be mistaken. Commented Sep 6, 2012 at 19:35
  • True, but that's still second factor.
    – Joel H
    Commented Nov 26, 2012 at 15:36
  • It's a second factor but it does not (necessarily) add a new factor to the process, it adds a different option. It's still one-factor but with two choices. Commented Nov 29, 2012 at 22:40

My understanding is that after you've set it up, your phone or whatever device you are running the authenticator app on becomes your physical factor. No matter how it was set up, and this will depend on the implementation of the system, you now have a physical 'token', so in terms of security, after you enter your password you must have that token.

If you forget either, you can't get in, at least not without a bit of hassle, and so it's more secure than just having a password in your head, or worse still, stuck on a Post-IT note.


There are three groups of factors which can be used to protect your account from an unauthorized access: a knowledge factor (something you know), a possession factor (something you have), and an inherence factor (something you are).

The password is something you know and they are usually used as the only one or the first factor. If you use a one-time password as a second factor, the second factor is used - it’s something you have. You don’t know the secret key and you don’t know what OTP will be generated the next. The secret key is shown only in the moment of token creation. As soon as you scan the QR code, it’s stored in some phone’s protected memory areas. If your phone isn’t rooted, you won’t be able to retrieve it. To generate the OTP some additional devices are required: if the OTP is generated by Google Authenticator, it’s your smartphone; an alternative is a hardware token. If the thief knows your password, he won’t get an access to your account until he owns your device which generates OTP. As nobody knows the secret key it cannot be considered as an equivalent to the usual password. So, the password and the OTP are different factors.

  • So it's a knowledge factor, but instead of me, only my phone has knowledge, making it separate from my own knowledge. I get it now. It is similar to a lock with two keys.
    – Basilevs
    Commented Mar 2, 2018 at 16:52
  • Your password is a knowledge factor and an OTP is a possession factor. Only the person who possesses the device with OTP can get an access to the account as an OTP can be used only once and usually changes every 30 or 60 seconds.
    – Christian
    Commented Mar 2, 2018 at 17:18
  • It can't be a possession factor without hardware protection. If the key is in principle extractable, it is the same a code book or password. The only difference is that I personally is not aware of it.
    – Basilevs
    Commented Mar 2, 2018 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.