Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Is it safe to re-use my username and password as information for the 2nd-factor?
For instance:
Would this scheme be secure?
As originally described, the system of having the two factors be [password, H(username || password)] is no more secure than the password alone.
The intent of Two-Factor Authentication is that you are improving security by requiring two independent factors for authentication. In the proposed model your second factor is fundamentally the same as the first. Assuming the hash function is publicly known as part of the protocol, then once your password is compromised then both factors are compromised.
Adding a key to the hash (i.e. a keyed hash) could potentially improve security depending on how that key was generated/shared. You would need to describe the whole system of course.
Nevertheless, There are a number of rigorously analyzed 2FA methods. Something like a TOTP token or U2F hardware key does add significant independent security to a password. You would be well served to investigate existing constructions and analysis.
