An authentication factor is a category of evidence used to verify that an entity controlling an account is its legitimate owner. Authentication factors support trust in digital relationships and provide the basis for later authorization decisions. section 3.10 section 2.6.3
Factors differ in what they require and how attackers may compromise them:
- Knowledge factors require something known, such as a password, PIN, or security question; phishing, credential stuffing, brute force, sharing, and loss weaken them. section 3.5.1
- Possession factors require something held, such as a smartphone, hardware token, smart card, or security key; loss, theft, cloning, and phishing remain possible. section 3.5.1
- Inherence factors use biological traits, including fingerprints, facial recognition, retina scans, and voice recognition; local device storage reduces risks associated with remote biometric databases. section 3.5.1
- Behavior, location, and temporal factors usually strengthen authentication through risk-based, contextual evaluation rather than serving alone as direct authentication. section 3.5.3
A common workflow combines an identifier with one or more factors. During registration, the service binds selected factors to the identifier and stores them securely; during login, it verifies the submitted evidence before granting or denying access. Multifactor authentication combines two or more factors, often a password with a one-time password (OTP) delivered by SMS, email, push notification, or an authentication app. section 3.6.3 section 3.10
Progressive login
Alice enters an identifier, supplies her password, and then approves a push notification from an authentication app. The service verifies the identifier and bound factors before allowing access. section 3.6.3
Figure 3.7 Identifier with authentication factors flow. During registration, Alice provides an identifier (such as a username or email) and one or more authentication factors (such as a password or biometric). The authentication service securely stores them. At login, Alice is prompted for her identifier and corresponding authentication factors. The service verifies both before granting or denying access. This is the most common authentication pattern, and it serves as the foundation for multifactor authentication, where the combination of factors improves security by requiring control over multiple types of evidence.
Follow the registration-to-login flow showing how an identifier and authentication factors are securely bound, presented, and verified. section 3.6.3
