securityWhy two passwords do not necessarily make two factors
Multifactor authentication checks evidence from different categories, such as something you know and something you possess. Two passwords both belong to the knowledge category, so they do not create the same separation. The aim is to make one compromised type of evidence insufficient for access.