I have been reluctant to move to 2FA for some reasons… Here is a use case.
- The user has two Google accounts (personal and business)
- Both accounts are configured on the Android smartphone
- Two-Factor-Authentication is enabled on both accounts
Now, under normal circumnstances, whenever the user wants to login the 2FA kicks in as an extra over the standard password.
The fun comes now, the user lets the phone on a desk and a funny person (or a thief!) takes the phone. Let us asume the phone does not have any PIN, gesture or fingerprint Access control. The thief takes the phone, sees the Google accounts, browses them and wants to be bad and decides to hijack both accounts.
Now, the thief or the funny person just happens to guess the password of one of the accounts, that is bad. But hey! good thing 2FA is enabled on the account! right?
Well, that thief or funny person that took the phone and was lucky to guess the password, gets the 2FA notification but since the phone he stole is in his control, then the 2FA is actually not doing anything because the intruder has the phone and does the 2FA on the stolen phone, the real owner does not get anything.
So, how is two-factor-authentication good then? Sure, you have to get the password first but if you do then 2FA does not seem to offer anything to protect if the intruder also has the authenticating device.
I hope somebody can explain that to me and tell me my assumptions are incorrect.