Authentication is the process of confirming that a user, device or service is who it claims to be, typically by checking something it knows, has or is.
Assessment. Passwords are not going away and pretending otherwise delays the fixes that work. Length matters more than complexity rules, a password manager outperforms memory, a second factor outranks any password, and a passkey outranks all of them where it is offered. Policies that force rotation and special characters make users weaker and feel stronger, which is the worst combination in security.
Factor
Examples
Fails when
Something you know
A password, a PIN, an answer to a question
It is guessed, reused from a breached site, or phished
Something you have
A phone app code, a hardware key, a certificate on a device
The device is stolen, or a one-time code is relayed to an attacker in real time
Something you are
A fingerprint, a face
The template is copied, or the sensor is fooled; a biometric cannot be changed after a leak
Somewhere you are, or some way you behave
Location, typing rhythm, usual device
Used as signals to raise or lower friction, not as proof on their own
A single factor is one point of failure, and passwords are the weakest single factor because people reuse them and attackers collect them. The current guidance from the standards body that most policies copy is blunt about what helps and what does not: allow long passwords and check them against lists of known-breached ones; do not require special-character rules, which push people toward predictable substitutions; do not force periodic rotation, which pushes them toward incrementing a number; and offer a second factor. That guidance reversed decades of policy, and many organisations have not caught up.
The direction of travel is away from shared secrets altogether. A passkey is a key pair held by the device or a password manager: the service stores the public half, the device signs a challenge with the private half, and nothing that could be phished or replayed ever crosses the network. Where a service offers passkeys they are the strongest option most users will ever have access to, and they are also the least understood, which is why the courses and exam questions on this subject still devote most of their attention to the password rules that passkeys make irrelevant.
In practice
A company's password policy requires eight characters, one capital, one digit, one symbol, and a change every ninety days. Its users respond exactly as the research predicts: a dictionary word, a capital first letter, a digit that increments each quarter, and an exclamation mark. The policy is compliant with a standard from fifteen years ago and produces passwords an attacker can enumerate. The replacement policy asks for a minimum length only, screens new passwords against a breached-password list, drops rotation except after a suspected compromise, and requires a second factor for everything. It is less work for users and materially harder to attack, and the only resistance to it comes from the audit checklist that still asks about rotation.
Authentication is one step: proving who you are. Identity and access management is the whole lifecycle around it, from creating the account to deciding what it may reach to closing it when you leave.
Multi-factor authentication is authentication with more than one kind of factor. Every multi-factor login is authentication; most authentication is still, unfortunately, one factor.
Authentication settles who is asking; least privilege settles how little they should be allowed once that is known. A perfectly authenticated administrator with access to everything is the second problem, not the first.
Key takeaways
→Three factors: know, have, are. One is a single point of failure.
→Current guidance: long passwords, breach screening, no forced rotation, no complexity theatre, a second factor.
→Passkeys remove the shared secret entirely and are the strongest option where offered.
No. The standards body whose guidance most policies copy now advises against periodic rotation unless there is evidence of compromise, because rotation produces predictable patterns. Screen new passwords against breach lists instead.
What is a passkey?
A key pair held by your device or password manager. The service keeps the public half; your device signs a challenge with the private half at login. Nothing reusable crosses the network, so there is nothing to phish, and it is the strongest common option today.
Is a security question a second factor?
No. It is a second thing you know, and usually a weaker one than the password, because the answers are guessable or public. A second factor has to be a different kind of thing: something you have or something you are.
Sources
The primary text this definition rests on. Read it before relying on this one.
