Authentication

Authentication is the process of verifying that a person, device or program really is who or what it claims to be, usually before a system grants access. It answers the question "who are you?" by checking evidence against what the system already knows. Logging in to email, unlocking a phone with a fingerprint, a server proving its identity to a browser with a certificate and an API client presenting a token are all authentication, and most security measures downstream depend on getting it right.

Evidence for authentication is grouped into factors: something you know, such as a password or PIN; something you have, such as a phone, a hardware security key or a smart card; and something you are, such as a fingerprint or face. Each factor fails differently. Knowledge can be guessed, phished or leaked, possession can be stolen, and biometrics cannot be changed if copied and are usually matched probabilistically, with false accepts and false rejects traded off against each other. Multi-factor authentication (MFA) requires evidence from at least two different categories, so that stealing one is not enough. Two passwords are still a single factor, and the one-time codes of TOTP (RFC 6238), generated by an authenticator app from a shared secret and the current time, count as possession of the device holding the secret.

Passwords should never be stored directly; a system stores a salted hash produced by a deliberately slow function. A cryptographic hash turns a password into a fixed-size fingerprint that cannot practically be reversed, and a salt, a random value stored beside each hash, ensures that two users with the same password get different hashes and defeats precomputed tables. General-purpose fast hashes such as plain SHA-256 are a poor choice because attackers can test billions of guesses per second on GPUs, so password storage uses purpose-built algorithms: bcrypt (1999), scrypt, and Argon2, the winner of the Password Hashing Competition in 2015. Even so, hashing cannot rescue weak passwords, and reuse across sites lets a leak at one service become credential stuffing at another. Current guidance, such as NIST's SP 800-63B, favors length and breached-password checks over forced complexity rules and frequent rotation.

The strongest modern approach removes the shared secret altogether: FIDO2, a standard from the FIDO Alliance (founded 2013) and the W3C that combines the WebAuthn browser API with the CTAP protocol for authenticators, uses public-key cryptography. At registration the device creates a key pair for that specific site and gives the site only the public key; at login it signs a challenge with the private key, which never leaves the device and is unlocked locally by a PIN or biometric. Because the signature is bound to the site's real domain, a phishing page cannot collect something reusable. Passkeys are the consumer name for these credentials, which can sync between a user's devices through a platform account. One-time codes and SMS texts, by contrast, can still be relayed to a fake site by an attacker, and SMS is further exposed to SIM-swap fraud, so they are better than a password alone but weaker than FIDO2.

Authentication is not authorization, and mixing them up causes real vulnerabilities. Authentication establishes identity; authorization decides what that identity may do, through roles, permissions or access-control lists. A user who is logged in is not thereby allowed to read another user's records, and a common web flaw is an endpoint that checks the login but not ownership of the requested object. Protocols reflect the split: OAuth 2.0 is a framework for delegated authorization, while OpenID Connect adds an identity layer on top for sign-in with an existing account. Machines authenticate too, through API keys, signed tokens and mutual TLS certificates, and a leaked key in a public code repository is a frequent route into cloud accounts and into the services that serve machine-learning models.

Read authentication as proving identity with evidence the claimant alone should be able to produce: layered across factors to survive any one failing, stored as slow salted hashes so a breach does not expose it, moving toward phishing-resistant keys that never travel, and always kept separate from the later question of what the proven identity is permitted to do.