IAM building block · 3 min read
Authentication: proving who someone is
Short answer
Authentication is the process of verifying that a user or service is who it claims to be, using one or more factors (something you know, have or are); strong authentication today means phishing-resistant multi-factor methods such as passkeys or FIDO2 security keys for people, and certificates or signed assertions for services.
Key takeaways
- Passwords alone are not enough for anything that matters; combine factors, and prefer phishing-resistant ones.
- Passkeys (FIDO2/WebAuthn) resist phishing because the browser binds the credential to the site's origin.
- Service-to-service authentication should use mTLS, signed JWT client assertions or workload identity, not shared passwords.
Every access decision starts with authentication. If an attacker can sign in as your user, every control after that point works for the attacker. That is why authentication has seen the biggest changes in identity over the last decade: from passwords, to passwords plus codes, to credentials that cannot be phished at all.
What are authentication factors?
Factors are categories of evidence: something you know (a password or PIN), something you have (a phone, security key or certificate) and something you are (a fingerprint or face).
Multi-factor authentication combines at least two categories. Two passwords are still one factor. A biometric on a phone usually unlocks a key stored on that phone, so in practice it combines "have" (the device) and "are" (the biometric).
Which methods are strongest?
Phishing-resistant methods: passkeys, FIDO2 security keys and smart cards.
| Method | Factor(s) | Phishing-resistant | Notes |
|---|---|---|---|
| Password only | Know | No | Reused, guessed, phished |
| SMS or voice code | Have (phone number) | No | SIM swap, interception; restricted by NIST |
| Authenticator app code (TOTP) | Have | No | Can be relayed by a fake site |
| Push approval | Have | No | Prompt bombing; number matching helps |
| Passkey (synced or device-bound) | Have + know/are | Yes | Bound to the site origin by the browser |
| FIDO2 security key | Have (+ PIN) | Yes | Strong choice for admins |
| Smart card / PIV | Have + know | Yes | Common in government |
A passkey is a FIDO2 credential: a key pair created for one website. The private key stays in the authenticator; the site stores the public key. At sign-in the browser checks the site's origin before the authenticator signs, so a look-alike domain gets nothing useful.
How do assurance levels work?
NIST SP 800-63B defines Authenticator Assurance Levels: AAL1 (single factor), AAL2 (two factors) and AAL3 (hardware-based, phishing-resistant, with verifier impersonation resistance).
Organizations outside the US often use the same model, or national and EU equivalents such as the eIDAS levels low, substantial and high. Pick the level per application based on the harm a wrong sign-in could cause.
How does authentication reach applications?
Through federation: the identity provider authenticates the user once and sends the application a signed statement of the result.
In OpenID Connect, the ID token carries auth_time, acr (the assurance class) and amr (methods used, with values registered in RFC 8176 such as pwd, otp, hwk and mfa). In SAML, the AuthnStatement carries AuthnInstant and an AuthnContextClassRef. Applications that need step-up can request a higher level with acr_values or max_age. Decode a sample ID token in the JWT Decoder to see these claims. The federation guide covers the trust side.
How should services authenticate?
With credentials that can be rotated and are bound to the workload: mutual TLS, signed JWT client assertions, or the platform's workload identity.
Shared passwords and long-lived API keys in configuration files are the service-world equivalent of password-only sign-in. OAuth 2.0 offers private_key_jwt client authentication (RFC 7523) and mTLS (RFC 8705). Cloud platforms issue short-lived workload identities to running services. Use them, and rotate whatever static secrets remain.
What about account recovery?
Recovery is authentication too, and often the weakest path.
If a user who loses their passkey can recover with an SMS code, your effective strength is the SMS code. Offer more than one strong method per user, require a second strong factor or identity verification for recovery, and alert the user through existing channels when recovery happens.
Questions
What does phishing-resistant MFA mean?
Authentication that an attacker cannot relay from a fake site. FIDO2/WebAuthn credentials, including passkeys, and PKI smart cards qualify because the authenticator checks the origin or the TLS channel. One-time codes and push approvals do not, because a user can be tricked into entering or approving them on a fake site.
Are SMS codes still allowed?
NIST SP 800-63B treats SMS and voice delivery as restricted: allowed with conditions and risk considerations, but not recommended for high-assurance use. They remain far better than passwords alone.
What is the difference between authentication and authorization?
Authentication establishes identity. Authorization decides what that identity may do. A sign-in is authentication; checking whether the signed-in user may delete a record is authorization.