User Authentication · 5.1
🔑 Authentication Factors
Something you know, have, or are — and why one is never enough⏱ ~2 min
Authentication answers the question: are you who you claim to be? There are three fundamental factors, and each has fundamentally different security properties.
| Factor | Examples | How It's Compromised | How It's Verified |
|---|---|---|---|
| Something you know | Password, PIN, security question | Phishing, brute force, data breach, shoulder surfing | Compare to stored hash |
| Something you have | Smartphone (TOTP app), hardware key (YubiKey), smart card | Physical theft, SIM swapping, malware on device | Cryptographic challenge/response |
| Something you are | Fingerprint, face, iris, voice | Spoofing, coercion, template theft from database | Biometric sensor + liveness detection |
Why Combine Factors?
🔒 SecurityMulti-Factor Authentication (MFA) requires two or more factors from different categories. An attacker who steals your password still needs your physical phone (TOTP) or hardware key. An attacker who steals your phone can't log in without your password. The two factors defend against completely different attack vectors.
Authentication vs Authorization
Authentication (AuthN)
- •Verifying identity: who are you?
- •Happens at login
- •Credentials: password, biometric, token
- •Result: confirmed identity (or denied)
Authorization (AuthZ)
- •Verifying permission: what can you do?
- •Happens after authentication
- •Controls: roles, policies, ACLs
- •Result: access granted or denied to specific resource
★ FactConfused Deputy Problem: a program with high privileges can be tricked into misusing those privileges on behalf of a less-privileged caller. Authentication proves who you are; authorization is the separate question of what you're allowed to do. Systems that conflate the two have confused deputy vulnerabilities.
🧠Quick Checkfirst try = +5 XP
Which is an example of TWO-factor authentication?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days