What’s the point of 2FA, if there’s a recovery code you can use when you lose ability to use your 2FA device?

Question

In the end, isn’t that recovery code just the same as a password?

In: 174

Answer 1

There’s some good info here, but I think a lot have missed the point. Let me add my .02…

There are several ways to authenticate somebody behind a keyboard. For many years, we’ve relied on “something you know.” That is, a password.

We could also authenticate you based on “something you are.” So… fingerprints, retina scan, palm vein, even walking gait.

Lastly, we can authenticate based on “something you have.” A “key file,” a phone, an RSA key.

Two factor authentication (2FA), or Multi factor authentication (MFA), uses a combination of two or more of these methods. So when you’re setting up 2FA and they provide you with backup codes, this is still “something you have” and should be used as a last resort to reconfigure your MFA as necessary.

To answer your question: No, the backup/recovery code is not a password. Your password is your password. Your recovery code will allow you to reconfigure your MFA solution in the event you lose the “something you have” factor of your MFA solution.