As is often the case in this discussion, the die hard security people will quote the definition of “true” multi-factor with the standard “at least two of someth

As is often the case in this discussion, the die hard security people will quote the definition of “true” multi-factor with the standard “at least two of something you ____”, but this level of security isn’t needed for most sites. I find it helpful to think of most “2-step” logins as simply an extension of passwords (one-factor), plus an admission that both users and web sites/apps are completely incapable of following the rules of password management. Users can’t stop reusing passwords, and web sites can’t properly store them and avoid getting hacked. 2 step logins are a method to force users to use a password that changes every 30 seconds, and that password is unique per web site/app. It shouldn’t be seen as a true multi-factor in the traditional sense.