So here's the deal, say I don't want to store passwords because that opens me up to all sorts of failures (see: Facebook). Instead, I want to use the passwords as a key for something else.
Let's assume our process is:
- User enters a password, we use 2FA, so we use that password to DECRYPT (via some KDF + et. al.) the Phone Number or Email (whatever the 2FA calls for here), and start the 2FA process;
- User passes 2FA, we log them in;
Now, my thought is that this should be an acceptable process, but I'm not a cryptographic expert on anything, so I'm curious on whether this is an adequate method of storing the password + 2FA component. It seems reasonable, after all, we're no longer actually storing the password, and with a sufficiently-strong KDF we add another layer of security by not using the raw password in the encryption process, meaning if someone manages to break it (let's say we use something like AES-256, or whatever the de-facto standard is) and extract the key, they have the KDF-transformed key, not the raw key.
Additionally, my thought here is that this solves the following problems:
- Storing the password in plain-text (obviously);
- Abusing the MFA components (as a certain, nameless, company has starting using that Phone Number for marketing purposes);
Does this make sense? Am I talking about something the world / experts have decided is a terrible idea?