Authentication: Meaning, Methods and Examples

What Does Authentication Mean?

Anyone who logs in somewhere claims: "I am this person." Authentication checks whether that is true. Only then does the user get access to accounts, data or systems.

This happens all the time in daily life: when you unlock your smartphone, log in to your mailbox or pay with your bank card and PIN. Devices and programs also authenticate each other, such as one server to another.

Authentication and Authorization

Three steps are often mixed up:

1. Proving identity: The user shows who they are. They enter a user name and password or place a finger on the sensor. German calls this step "Authentisierung".
2. Checking identity: The system checks this proof. Does the password match the account? German calls this step "Authentifizierung". In English, both steps together are "authentication".
3. Authorization: The system decides what the user may do. May they only read the file, or also change it?

An example: at the airport, you show your passport. The officer checks it. Both together are authentication. Your boarding pass decides which plane you may board. That is authorization.

The Three Factors of Authentication

• Knowledge: something only the user knows, such as a password, a PIN or a security question.
• Possession: something only the user has, such as a smartphone, a smart card or a hardware key.
• Inherence: something the user is, such as their fingerprint or face. Read more under biometric authentication.

If two or more factors from different categories are combined, this is called multi-factor authentication (MFA), and with exactly two factors two-factor authentication (2FA). The German BSI recommends using two-factor authentication wherever a service offers it.

Methods at a Glance

• Password and PIN: the most common, but the weakest on their own. Passwords get guessed, stolen or reused across services.
• One-time codes: by app, text message or email. Codes from an authenticator app are safer than text messages.
• Push approval: an app asks whether to approve the login. Convenient, but risky if users approve requests without thinking.
• Hardware security keys: small devices for the USB port or via NFC, mostly based on the FIDO2 standard. They are seen as especially safe against phishing.
• Passkeys: passwordless login based on the FIDO2 principle. The secret key stays on the device and is unlocked with a fingerprint, face or PIN.
• Certificates and smart cards: common in companies and public offices, for example to log in to a computer or VPN.
• Biometrics: fingerprint or face, mostly to unlock a device or a key stored on it.

Challenge-Response Methods

Many secure methods work on the challenge-response principle. The server sends a random task, the challenge. The user's device uses a secret to compute an answer, the response. The server checks whether the answer is correct.

The benefit: the secret itself is never sent. Anyone listening in on the connection can do nothing with the answer, because the next challenge is a different one. Hardware keys and passkeys use this principle.

Authentication in Companies

In company networks, logins mostly run through central services. Staff log in once and then get access to many applications. This is called single sign-on (SSO). There are proven protocols for this:

• Kerberos: the standard for logins in Windows domains with Active Directory.
• SAML: common for logging in to web applications in companies. See SAML.
• OpenID Connect: builds on OAuth 2.0 and is used for web and mobile applications. OAuth 2.0 alone only handles authorization.

Who has which rights is managed by identity and access management (IAM).

Typical Attacks on Authentication

• Phishing: fake login pages steal credentials. See phishing.
• Credential stuffing: attackers try stolen credentials on many services. See credential stuffing.
• Password spraying: a few common passwords are tested on a large number of accounts. See password spraying.
• MFA fatigue: attackers keep sending push requests until the user gives in and approves.
• Session theft: attackers steal the session token after login. Then even MFA no longer helps.

Best Practices for Secure Authentication

1. Turn on MFA everywhere, first for admins, remote access, email and cloud services.
2. Prefer phishing-resistant methods: passkeys and hardware keys instead of text message codes.
3. Long, unique passwords: a password manager helps.
4. Monitor logins: spot unusual logins and lock accounts after many failed attempts.
5. Limit rights: grant only the rights needed, following the principle of least privilege.
6. Keep checking access: in the spirit of zero trust, checks do not happen only once at the start. See zero trust identity management.

Conclusion

Authentication checks whether someone really is who they claim to be. A password alone is no longer enough for this today. Several factors and phishing-resistant methods such as passkeys make accounts much safer. Together with sound authorization, they form the basis of every access control.