Several ways to prove that you are you

Logging in is the gate where you prove you are you

Last lesson said that security
is deciding what to protect and blocking the rest.
But before blocking, there is a first question to ask.
Who is this person standing at the door now?
If it is the owner, they should be let in;
if it is a stranger, they should be stopped.
So for each person who comes,
we set a gate that asks: are you really you?
This gate is exactly the login.
Showing here that you are you is called authentication.

Tap the person at the door to check who they are. Only the one who passes authentication gets in.

Only the confirmed person went inside.
Authentication is this gate that tells who is who.
But with what do you show who you are?
Just giving a name, anyone could copy that,
so a name alone is not enough.
There must be proof only you can show.
Such proof splits into three broad kinds.
Let's look at them one by one.

Something you know, have, and are

The proof that shows you are you has three branches.
First is something you know.
Like a password or a passphrase, held only in your head.
Second is something you have.
A thing in your hand, like a phone, a key, a pass card.
Third is something you are.
A trait on your body, like a fingerprint or a face.
What you know can be forgotten or leak out;
what you have can be lost;
what you are is always with you but hard to change.
Each has different strengths and weaknesses.

Tap each of the three factors to look it over. It tells you each one's strength and weakness.

Each of the three has a different weakness.
So trusting just one is risky.
If you use only one password and it leaks,
someone else can pretend to be you outright.
Then how do we block more firmly?
It is simple.
Require two different factors stacked together.
Next we see the power of this stacking.

Stacking several layers is safer

Put a single lock on a door,
and losing that key lets anyone open it.
But put two locks on,
needing two different keys to open both,
and losing one still leaves the other to block.
Authentication is the same.
Match the password (something you know),
and also confirm with my phone (something you have),
and even if the password leaks, without the phone no one gets in.
Asking different factors stacked like this
is called multi-factor authentication.

Tap to compare the safety of using one factor versus stacking two.

With two layers instead of one,
breaking through got far harder.
The attacking side must get both at the same time.
They would need to know the password and hold my phone,
and that is far rarer.
So the more important a place, the more layers we stack.
Now, but after letting someone in, there is another issue.
Getting inside does not mean
you may do anything at all.
Next let's talk about that.

Who you are and what you may do differ

Say you have entered a company building.
With a pass card you proved you are an employee.
This is authentication; it confirmed who you are.
But being an employee does not mean
you may enter every room.
Only specially allowed people enter the vault room.
Deciding what you may do, like this,
is authorization.
Authentication asks who you are;
authorization then sets what you may do.
And authorization can be taken back if needed.

Confirm who someone is with authentication, then set what they may do with authorization. You can take the permission back.

Confirming who someone is and
setting what they may do ran separately.
The same person could be given more permission
or have it taken back.
An operating system also, for each user,
sets separately what they may do.
Even past the door by authentication,
there are places you cannot touch without permission.
Keeping the two apart lets us
manage who came in and
what that person may touch
separately, which is safer.

Let's wrap up

Gathered on one line, it is this.
Authentication is proving that you are you.
The materials for proving are three:
something you know, have, and are.
Using just one is weak,
so stacking different factors in several layers is safer.
This is multi-factor.
And authentication is not the same as authorization.
Authentication asks who you are;
authorization sets what you may do.
Confirm who, harden with layers, set actions apart. That is authentication.

Tap the key points in order to review. (prove you are you -> know/have/are -> several layers, multi-factor -> authentication differs from authorization)

Now you know, all the way through,
what the guard at the door does.
It tells you that you are you,
confirms firmly with several layers,
and even sets apart what you may touch inside.
Only when these three mesh
can we open the door with peace of mind.
Next, how to keep the words exchanged after passing
from leaking along the way,
let's keep exploring together.