4 ms·

That's technically not two factor if you only need to know a password to get access to the one-time code. It's two passwords, both are something you have to kn

That's technically not two factor if you only need to know a password to get access to the one-time code. It's two passwords, both are something you have to know, there's nothing you need to have or be (sms and biometrics respectively)

romwell 8y ago
Your comment highlights why phone-based 2FA is not a 2FA.
- cube2222 8y ago
  It is, you need to have the phone. But if you can access the phone content remotely behind a password, then it stops being 2FA.