Authentication (authn) verifies that a requester is the entity it claims to be. It solves the online proximity problem by renewing a digital relationship when a person, service, device, or other principal interacts with a system. Accounts retain identifiers, credentials, and attributes; authentication tests whether the current requester should still be connected to that account. section 1.1 section 2.8
This is not merely a login-screen feature. Enrollment establishes the relationship, while authentication preserves it through use, updates, recovery, and termination. Weak proofing, stale credentials, spoofed attributes, or poor account-life-cycle management can make a system confidently recognize the wrong party. Logging and auditing provide evidence for assessing whether the identity system remains trustworthy. section 2.6.3 section 3.9
When valid credentials are not enough
Attackers used social engineering and phishing to obtain internal credentials and access administrative tools, then took over prominent accounts. The incident shows that sound cryptography alone cannot protect authentication: credential reset processes, help-desk procedures, multifactor authentication (MFA), and governance also determine whether an attacker can impersonate a legitimate user. section 3.0 section 3.2
Authentication methods increase in strength from a claimed identifier toward cryptographic proof:
- Identifier-only methods accept a stated identity and have limited safe uses. section 3.6
- Token-based methods rely on a token whose strength depends on the authentication used to issue it. section 3.6 section 3.7.2
- Identifier-and-factor methods combine an identifier with evidence such as knowledge, possession, inherence, behavior, location, or time. section 3.10
- Challenge-response methods use cryptographic proof and can resist phishing and replay attacks. section 3.10
Figure 3.9 The strength and usability pyramid for authentication methods. As you ascend the pyramid, authentication mechanisms become more resistant to phishing, replay attacks, and credential theft, though some may require a more technical setup or infrastructure. Passwords, located at the base, offer poor security and usability, while challenge–response methods such as passkeys and PKI provide high assurance with an improved user experience. Multifactor approaches (MFA) are positioned across the middle tiers, balancing security and usability by combining various types of factors.
Compare passwords, one-time codes, push notifications, passkeys, PKI, and MFA by their security, phishing resistance, and usability tradeoffs. section 3.7.2
Stronger authentication improves confidence but must be chosen with usability and threats in view. Passwords are vulnerable to credential stuffing; SMS and email one-time passwords can be phished or intercepted; push notifications can face MFA fatigue. Passkeys and PKI challenge-response approaches offer stronger phishing resistance, while lost devices, weak device security, malware, and supporting infrastructure remain relevant risks. section 3.7.2
Authentication answers who or what is making a request; authorization answers whether that request may proceed. Authentication also supplies context—such as roles, attributes, device posture, location, session freshness, and recent signals—that can inform an access decision. It cannot by itself determine which actions, resources, or conditions are allowed. section 3.8 section 15.2
In zero-trust settings, authentication is the start rather than the end of a decision. A reliable session, multifactor authentication, mutual TLS, or workload identity establishes evidence about a principal, but policy still evaluates the action, resource, and context. This distinction also matters for AI agents: identifying an agent does not predict its next tool action, so each proposed action requires real-time authorization. section 15.2 section 18.2
