Proving control of an account
Once an account exists, a service needs to recognize someone returning to use it. Authentication checks evidence of account control; the method used determines what confidence that evidence can provide.
Returning to an account
Ava returns to the photo service and enters her email. The address helps the service find her account, but anyone who knows it could type the same thing.
The password supplies a different piece of information. A careful service doesn't keep Ava's password itself. When she chose it, the service stored a value computed from it, called a verifier, which lets the service check a later submission without being able to turn the stored value back into her password. At sign-in it repeats that computation on what she typed and compares the results. If they match, it has evidence for allowing this sign-in to proceed. The rules a service sets for the evidence it accepts, such as which methods are allowed and when a second one is required, make up its authentication policy.
What authentication establishes
This is authentication: checking control of an authenticator associated with an account. An authenticator is whatever Ava uses to show that control. It might be a password she remembers, an authenticator app on her phone that shows a new six-digit code every 30 seconds, or a security key, a small device that plugs into a computer or is held near a phone.
What the service accepts as evidence is a credential: something that belongs to one account and that only its holder should be able to present, such as Ava's password, or the credential a security key creates for her account when it is set up. The service registers each credential to the account, so it knows what to check. The association is essential. Buying a security key doesn't give someone access to Ava's account. The service must first register a credential from that key to her account through an authorized process, usually while she is already signed in.
Even a successful check has limits. Someone who steals Ava's password may satisfy it too. Authentication gives the service evidence about account control; it doesn't guarantee the person's identity or make every profile field true.
It also doesn't give Ava permission to delete other people's photos or manage everyone's accounts. The service must still check whether each requested action is allowed.
Successful sign-in
- Account control
- Evidence about account control
- Legal identity
- Not established
- Every profile field
- Not established
- Permission for the next action
- Still to check
Someone who steals Ava's password may satisfy it too.
Different kinds of evidence
Ava could know a secret, hold a registered authenticator, or use a biometric to unlock one. These are different kinds of evidence, called authentication factors:
- Something you know: a secret, such as a password or PIN.
- Something you have: control of an authenticator, such as a security key.
- Something you are: a biometric characteristic, such as a fingerprint.
A single method can combine these. A passkey is a credential that Ava's phone, computer or password manager creates for one website and keeps for her. When she signs in, the device proves it holds the passkey, and nothing she could type is sent. The device asks for her fingerprint, face or PIN before it does so. The fingerprint stays on the device: it unlocks the passkey locally, and the authenticator then proves control of its credential to the website. The site doesn't need to receive the fingerprint itself.
Building confidence
The service might ask for Ava's password and then a code from her enrolled authenticator app. The two checks combine knowledge of a secret with control of an authenticator.
An authentication policy may require more than one kind of evidence. Multi-factor authentication, or MFA, uses more than one type of factor. Asking for two passwords would still use the same type, however many screens the service displayed.
The methods also matter. Phishing means tricking someone into using a fake site that imitates a real one, usually through a convincing message with a link. A fake sign-in page can collect both Ava's password and her current code, and whoever runs it can pass them straight on to the real service while the code still works. Two factors didn't help, because Ava typed both into the wrong place.
Phishing-resistant methods are designed to stop that kind of impersonation. A passkey or security key checks which website is asking before it responds, and it works only for the site it was registered with. A look-alike page receives nothing it can use, however convincing it looks to Ava.
Password + secret answer
- Something you know
- Something you have
- Something you are
- Factor types
- One
- Look-alike page
- Can collect both
Two knowledge checks: the same factor type.
Password + authenticator app
- Something you know
- Something you have
- Something you are
- Factor types
- Two
- Look-alike page
- Can collect both
Knowledge plus control of an enrolled authenticator.
Passkey + fingerprint
- Something you know
- Something you have
- Something you are
- Factor types
- Two
- Look-alike page
- Receives nothing it can use
Checks which website is asking before it responds.
Check your understanding
Try these questions before moving on. If an answer isn't right, use the feedback and try again.
Try it in the Lab
- Follow Ava through a sign-in and two refusalsSign Ava in with her password and an authenticator app, find what the tenant checked, and see why signing in does not grant every kind of access.