1 — Identification, authentication factors and MFA
Study time: ± 45–60 minutes (reading + one cheat sheet)
Claim, then prove
Identification is claiming who you are — typing your username, saying your name at a desk. Authentication is proving that claim — your password, your passport, your fingerprint. A username identifies; only the proof authenticates. Keep these apart: many security discussions go wrong because they blur this line.
The authentication factors
Proof comes in categories. The classic four:
| Factor | What it is | Examples | Main weakness |
|---|---|---|---|
| Something you know | A secret in your memory | Password, PIN | Can be phished, guessed, reused across sites |
| Something you have | A physical or logical token | Hardware key (e.g. YubiKey), smartcard, your phone | Can be lost or stolen — but not copied remotely |
| Something you are | A static biological trait | Fingerprint, face, iris | Not a secret (you leave fingerprints everywhere), needs liveness detection, cannot be replaced if leaked |
| Something you do | A behavioural pattern | Typing rhythm, gait, signature dynamics | Varies with stress or illness; supports continuous authentication |
Biometric systems balance two error rates: the False Accept Rate (intruders let in) versus the False Reject Rate (legitimate users locked out). Tightening one loosens the other; the right threshold depends on what the system protects.
Multi-factor authentication (MFA)
Real MFA combines factors from different categories — password (know) + authenticator app (have). Two factors from the same category is not MFA: a password plus a security question is twice "something you know", and a single phishing attack captures both. The factors must not be compromisable by the same attack.
On passwords themselves: modern guidance (NIST SP 800-63, Revision 4) emphasises length over complexity, drops arbitrary composition rules, and requires a password change only on evidence of compromise — not on a calendar schedule. Security questions are no longer an acceptable factor at all.
Core resources
- OWASP Multifactor Authentication Cheat Sheet — practical implementation guidance, including the factor types and their trade-offs. (± 20 min)
- OWASP Authentication Cheat Sheet — password policy, login throttling, secure password storage pointers; apply this directly in your project. (± 25 min)
- Reference: NIST SP 800-63-4 — look up the assurance levels (IAL/AAL) when you need to argue "how strong is strong enough".
Check yourself
- Which of these is real MFA, and why: (a) password + PIN, (b) password + fingerprint, (c) bank card + PIN, (d) password + security question?
- At a concert entrance a visitor states their name and shows their ID. Which part is identification, which is authentication?
- Why can a leaked fingerprint be worse than a leaked password?