What is authentication

Logging in is the gate where you prove who you are

The last two lessons were about storing passwords safely. This time we look at the place where those passwords are used: logging in. Before a door can be guarded, there is a first question to ask: who is the person standing at the door right now?
The owner should be let in and a stranger stopped. So there is a gate that asks everyone who comes whether they really are who they claim to be. That gate is the login, and showing there that you are you is authentication.

Tap a person at the door to check who they are. Only someone who passes authentication gets inside.

Only the confirmed person went inside. But how do you show who you are? Anyone can give a name, so a name alone is not enough. There has to be proof that only you can produce.
Such proof falls into three broad kinds. Let's look at them one by one.

Something you know, something you have, something you are

Proof that you are you comes in three kinds. The first is something you know: information that lives only in your head, like a password or a PIN. The second is something you have: an object in your hand, like a phone, a security key or a pass card. The third is something you are: a feature of your body, like a fingerprint or a face.
Each has its own weakness. What you know can be forgotten or leak to someone else, and what you have can be lost or stolen. Your body's features are always with you, but once copied they cannot be changed the way a password can.

Tap the three factors one by one to open them. Each shows its strength and its weakness.

Each of the three factors had a different weakness. So relying on only one is risky. If you use a single password and it leaks, someone else can simply pretend to be you.
The way to block this more firmly is simple: require two or more factors of different kinds together.

Stacking layers is safer

With only one lock on a door, anyone who gets hold of the key can open it. With two locks that need two different keys, losing one still leaves the other in the way. Authentication works the same way.
If you have to enter your password (something you know) and also confirm on your phone (something you have), a leaked password is not enough for someone without your phone. Asking for factors of different kinds like this is called multi-factor authentication. Asking for two passwords is just two of the same kind, so it does not count.

Tap to compare the safety of using one factor with stacking two.

Two layers were far harder to break through than one. An attacker would need both your password and your phone, and having both at once is much rarer. That is why important places such as banks ask for several layers.
Codes sent by text message, though, can be caught by tricks that hijack a phone number, so authenticator apps or security keys are sturdier. And even after someone is let in, there is still work to do, because getting in does not mean you may do anything you like.

Who you are and what you may do are different

Say you have entered a company building. Your pass card proved that you are an employee; that is authentication. But being an employee does not mean you can enter every room. Only people with special permission can enter the vault.
Deciding what a confirmed person may do is called authorization. Authentication asks who you are; authorization then decides what you are allowed to do. Permissions can be taken back whenever needed.

First confirm the employee with authentication, then tap rooms to turn entry permission on and off. You can also take back every permission at once.

Confirming who someone is and deciding what they may do worked separately. The same person could be given more permissions or have them taken back. An operating system sets separately what each user may do, and web services likewise split the features available to ordinary members and administrators.
Keeping the two apart lets you manage who came in separately from what that person may touch. Even if an account's authentication is broken, the damage stays small if its permissions are small.

Wrapping up

In short, authentication is proving that you are you, and the materials of proof are of three kinds: something you know, something you have and something you are. One alone is weak, so stacking factors of different kinds is safer; that is multi-factor authentication.
And authentication is not the same as authorization. Authentication asks who you are; authorization decides what you may do.

Tap the key points in order to review. (proving you are you → something you know, have and are → several layers of multi-factor authentication → authentication differs from authorization)

Now you know in detail what the guard at the door does: tells who is who, checks firmly with several layers, and separately decides what you may touch inside.
After you pass the door, though, the messages you exchange still travel an unfamiliar road. The next lesson covers encryption, the way to stop anyone in the middle from reading those messages.