Re:A Really Good Article on How Easy it Is to Crack Passwords
by ajanuary on Thursday September 05, 2013 @05:53AM
(#6333110)
It's certainly better than just a password, and as you say is a nice balance between usability and strong passwords.
However, I'd be careful about thinking of it as any sort of 2-factor authentication and wouldn't bestow any of the advantages of 2-factor auth on your scheme.
A static secret, no matter how complex, doesn't really prove ownership because multiple people can trivially have a copy of the secret at the same time. So you don't have a knowledge and a physical factor, just a convoluted knowledge factor.
Better than just a password, but don't let it g e you a false sense of security.
However, I'd be careful about thinking of it as any sort of 2-factor authentication and wouldn't bestow any of the advantages of 2-factor auth on your scheme.
A static secret, no matter how complex, doesn't really prove ownership because multiple people can trivially have a copy of the secret at the same time. So you don't have a knowledge and a physical factor, just a convoluted knowledge factor.
Better than just a password, but don't let it g e you a false sense of security.