Overview
Authentication is the process of verifying that someone (or something) is who they claim to be. It is the front door of almost every system. Get it wrong and every control behind it is undermined; get it right and you have a trustworthy foundation for everything else.
Learning objectives
- Define authentication and distinguish it from identification.
- Explain the three authentication factors.
- Understand why passwords alone are weak.
Core concept
Two closely related terms:
- Identification — claiming an identity (typing a username).
- Authentication — proving that claim (providing a password, code, or fingerprint).
Proof comes from one or more authentication factors:
- Something you know — a password, PIN, or passphrase.
- Something you have — a phone, hardware token, or smart card.
- Something you are — a biometric such as a fingerprint or face.
Using factors from two or more different categories is multi-factor authentication (MFA), which is far stronger than any single factor.
How it works
A password-based login compares what the user types against a stored hash of their password (never the plaintext — storing plaintext passwords is a serious error). Modern systems use slow, salted password-hashing algorithms (such as bcrypt, scrypt, or Argon2) specifically designed to make large-scale guessing expensive.
Practical example
You log into an email account: you identify by entering your address, then authenticate by entering a password (something you know) and a one-time code from an app (something you have). Even if an attacker has stolen your password, they cannot pass the second factor from their own device.
Cybersecurity relevance
Weak or reused passwords are behind a large share of breaches. Credential stuffing — trying passwords leaked from one site against many others — works precisely because people reuse passwords and many sites lack MFA. Strong authentication is one of the highest-value defenses a beginner can champion.
Common mistakes
- Confusing authentication with authorization. Authentication proves who you are; authorization decides what you may do (next lesson).
- Storing passwords in plaintext or with fast, unsalted hashes.
- Relying on passwords alone where MFA is feasible.
Key takeaways
- Authentication proves a claimed identity, using factors you know, have, or are.
- Combining different factor types (MFA) is far stronger than one factor.
- Passwords must be stored only as salted, slow hashes — never plaintext.
Check your understanding
- Classify each as know/have/are: a PIN, a fingerprint, a hardware security key.
- Why does MFA defeat an attacker who has stolen only your password?