Authentication

Authentication verifies identity using one or more factors: something you know (password, PIN), something you have (smartphone, hardware token), or something you are (fingerprint, iris pattern). These are often called knowledge, possession, and inherence factors. Multi-factor authentication (MFA) combines two or more factors to reduce the risk of compromise. For example, a bank may require a password and a one-time code sent to a phone.

Authentication is distinct from authorization: the former confirms who you are, the latter what you can do. Systems often implement both via identity and access management (IAM) frameworks. The strength of an authentication method depends on its resistance to attacks such as phishing, credential stuffing, and replay attacks.

Passwords remain the most common method, but they are notoriously weak: many users reuse passwords across sites, and breaches expose millions of credentials. To mitigate this, organizations deploy password managers, enforce complexity rules, and use breach detection services. Hardware tokens, such as YubiKeys, provide possession-based authentication and are resistant to phishing.

Biometric authentication uses unique physical or behavioral traits, such as fingerprints, facial recognition, or voice patterns. While convenient, biometrics raise privacy concerns and cannot be reset if compromised. Behavioral biometrics, like typing rhythm or mouse movement, are an emerging field. Single sign-on (SSO) allows users to authenticate once and access multiple services, often using protocols like SAML or OAuth.

Standards ensure interoperability and security. The FIDO2 standard, developed by the FIDO Alliance, enables passwordless authentication using public-key cryptography. WebAuthn, a component of FIDO2, is supported by major browsers and platforms, allowing users to authenticate with biometrics or hardware tokens. Passkeys, based on FIDO2, are increasingly adopted by tech giants.

OAuth 2.0 and OpenID Connect are widely used for delegated authorization and authentication in web applications. SAML (Security Assertion Markup Language) is common in enterprise SSO. Time-based one-time passwords (TOTP) are specified in RFC 6238 and are used in many MFA implementations. These protocols are maintained by organizations like the IETF and the W3C.

Beyond the mainstream, authentication has niche dimensions. Risk-based authentication (RBA) evaluates contextual signals—such as location, device, and behavior—to adjust the required level of verification. For example, a login from a new device may trigger an additional challenge. Continuous authentication monitors user behavior throughout a session, rather than only at login, to detect anomalies.

Quantum-resistant authentication is an emerging area, as quantum computers could break current public-key algorithms. Post-quantum cryptography standards are being developed by NIST. Another edge case is the use of authentication in the Internet of Things (IoT), where devices often have limited interfaces and require lightweight protocols. The history of authentication includes early systems like the Multics CTSS, which introduced the concept of passwords in the 1960s.

MFA

Multi-factor authentication; requires two or more verification factors.

FIDO2

A set of standards for passwordless authentication using public-key cryptography.

WebAuthn

A web standard for authentication using public-key cryptography.

OAuth

An open standard for delegated access, often used for authorization.