Two input authentication uses both username (may be available publicly) and password (kept secret).

For the sake of comparison, assume the length of username is the same as the length of password, i.e., n characters. Also assume we can only use case insensitive letters from a to z. If both username and password are kept secret then at most we need 26^(2n) trials to pass the authentication.

Now consider a new authentication system with only one single input, i.e., password that is kept secret of length 2n. The allowed characters are case insensitive, spanned from a to z. This system also needs 26^(2n) trials to be passed.

Questions

Why don't we use single input authentication?

When signing up for a service, you have a good chance of getting "This name is already in use, choose another" - or something to that effect.

In the system you propose, this would tell you that the access code is in use - great, open a new browser and log in with this access code! You've just hijacked somebody else's account.

You could find any number of existing access codes, just by trying to change your own.

Also, what if you forgot your access code? This can be mitigated if the system knows your e-mail address and can send you a new access code, but then you'd be close to a two-input authentication; you might as well use your e-mail to log in then.
