I understood you, my point is that you are sacrificing significant security with a one-factor approach, especially if that one factor is a password! You're open to attacks where the password is exposed in between the keyboard and the requestor, attacks on the distant end system, as well as attacks on the password device itself. Passwords make it tricky to audit if they've been duplicated.
Use 2fa everywhere. It's cheap, easy, and significantly more effective.
Consider the following attacks which your suggestion provides no coverage for:
- Http downgrade (both SSLstrip and export-grade downgrade)
- Spear-phish
- Key-logger
- Spear-phish
- Shoulder-surf
- Spear-phish
- Evil maid (borrows device and compromises passwords)
Use 2fa everywhere. It's cheap, easy, and significantly more effective.
Consider the following attacks which your suggestion provides no coverage for:
- Http downgrade (both SSLstrip and export-grade downgrade)
- Spear-phish
- Key-logger
- Spear-phish
- Shoulder-surf
- Spear-phish
- Evil maid (borrows device and compromises passwords)
And last but not least, spear-phish