2-Step vs 2-Factor Authentication (2FA)

03 April 2018
Cloud Computing
Written by George Dockrell

Two-factor authentication is one of the best things you can do to make sure your accounts don’t get hacked.

But hey, what is the exact definition of it? Is it same as two ‘step’ verification? Most of the people use two-step and two-factor interchangeably. There isn’t much theoretical need to create a difference, but technically both are two different things.

We all have been using authentications. Be it a bank login or accessing your personal email account, there is always a wall of authentication before it.

To login, we just need a basic authentication – username and password. Just knowing your username/password and you’re authenticated. But that’s just one factor authentication.

2 Step Authentication vs 2FA Example

Let’s make things very simple to understand. There are a few factors that determine the authentication methods. These factors are:

Something you know – Passwords
Something you have – Mobile Devices, Hardware/Software tokens
Something you are – Biometrics

As mentioned above, the user/password verification method belongs to ‘something you know’ factor. If a hacker wants to break into your account, he just needs to know what you know i.e. username/password. Only ‘something you know’ factor is being executed in authentication through passwords.

To successfully hack a two-factor authentication system, the hacker must not only ‘know’ your password but also ‘have’ the physical device you own. Thus, two FACTORS of authentication are involved here.

What is two ‘STEP’ authentication then?

Well, two-step authentication might require just one factor but more than one step to clear the verification.

In addition to passwords, you would need something more. Maybe a security question or a pin code.

Take an example of any email login. When you sign in from an unknown device, it prompts answer a security question in addition to username/password. You need to clear two steps here to get authentication.

1. First Step – Username/Password.
2. Second Step – Security Question.

Both steps are part of the same factor: something you know. You don’t need two factors here like you need during withdrawal of cash – ATM card (Something you have) + Password (Something you know).

While many people use the terms ‘two-step’ and ‘two-factor’ authentication interchangeably, now you know that technically you can’t.

If you are thinking to implement any authentication method to secure your applications or websites, feel free to be guided by our data security experts.

For any clarifications, chat now with our experts by clicking on the bottom right section of this page.

Also see: Azure MFA vs Office 365 MFA