🔐 Authentication & Password Security
Proving you are who you say you are — and making it hard to fake⏱ ~3 min
A nightclub bouncer checks your ID to prove you are who you claim to be. Authentication does the same thing digitally — it's the process of proving your identity before being granted access. The ID is your password. But what if someone makes a fake ID? That's why modern security adds more checks — something you have (a phone), something you are (your fingerprint). Two fake IDs are much harder to make than one.
The Five Authentication Factor Types
| Factor | Type | Examples | Weakness |
|---|---|---|---|
| Something You Know | Knowledge | Password, PIN, passphrase, security question | Can be guessed, stolen, or phished |
| Something You Have | Possession | Authenticator app, SMS code, hardware key (FIDO2), smart card | Device can be lost or stolen |
| Something You Are | Inherence | Fingerprint, Face ID, iris scan, voice recognition | Can't be changed if compromised; fails in some conditions |
| Something You Do | Behavior | Typing rhythm, swipe patterns, mouse movement | Can change with injury or stress; harder to implement |
| Somewhere You Are | Location | IP address, GPS geofencing, time zone | VPNs can spoof location; travelers trigger false alerts |
Multi-Factor Authentication (MFA)
MFA requires two or more factors from different categories. A password + SMS code = MFA (Know + Have). A password + another password = NOT MFA (both are 'Know'). The whole point is that an attacker who steals your password still can't log in without your phone.
- •Stolen in one phishing email
- •Cracked offline by automated tools
- •Reused on multiple sites (credential stuffing)
- •Colonial Pipeline attack: 1 stolen password → fuel shortage across SE United States
- •One attack = complete account takeover
- •Attacker needs password AND your physical phone
- •Phishing-resistant FIDO2 keys can't be intercepted even on fake sites
- •Even if breach exposes your password, your account stays safe
- •Google: MFA blocks 99.9% of automated account attacks
- •Attacker would need to physically steal your device too
Passphrases Beat Passwords
- •❌ P@ssw0rd! — looks complex but attackers know every substitution pattern. Cracked in seconds.
- •✅ canoe-window-pepper-orbit — 4 random words, 27 characters. Decades to crack by brute force.
- •Length beats complexity — every extra character multiplies crack time exponentially
- •Randomness beats patterns — 'i luv my d0g!' is weak because it follows a guessable structure
- •Password managers let you use a unique 20+ character random password on every site — no memorization needed
Common Password Attack Types
- •Brute Force — trying every possible combination (very slow for long passwords)
- •Dictionary Attack — trying common words and known password patterns first
- •Credential Stuffing — taking username/password pairs from one breached site and trying them everywhere else (works because people reuse passwords)
- •Phishing — tricking you into typing your password on a fake site
- •Shoulder Surfing — watching you type your password in public
- •Keylogger — malware that records every keystroke
After the RockYou2024 data breach exposed 10 billion passwords, an attacker uses automated tools to try those exact credential pairs against email providers and banks. What attack technique is this, and why does MFA stop it?