Why two passwords do not necessarily make two factors
Multifactor authentication checks evidence from different categories, such as something you know and something you possess. Two passwords both belong to the knowledge category, so they do not create the same separation. The aim is to make one compromised type of evidence insufficient for access.
Go deeper
Different categories create different barriers
Authentication asks whether someone can demonstrate the required evidence for an identity. Common factor categories include knowledge, possession and inherence, such as a biometric characteristic.
A password is something known. A security device can demonstrate possession. Combining different categories can prevent a stolen password alone from satisfying every requirement.
Counting prompts is not the same as counting independent factors. A password followed by another memorised answer still relies on knowledge.
- Factor categories describe the type of evidence.
- Implementation determines how that evidence is checked.
- Recovery procedures can affect the overall protection.
Not every multifactor method resists the same attacks. Some codes can be relayed through deceptive sites, while other methods bind authentication to the intended service. The category count is only part of the design.