authentication

Before a bank teller lets you withdraw money, they must answer one question: are you really who you claim to be? They might check your ID card, or ask for a password and a code texted to your phone. Authentication is exactly that step in a computer: verifying that a user (or a program) genuinely is the identity it claims, before the system decides what that identity is allowed to do. It is the front door — everything else hinges on getting it right.

The classic framing is that you can prove identity by one of three kinds of evidence, called factors: something you know (a password, a PIN), something you have (a phone, a hardware security key, a smart card), and something you are (a fingerprint, a face, an iris — biometrics). Take passwords, the most common know factor: a system must never store the raw password, because a leaked database would then hand attackers every account. Instead it stores a hash — the output of a one-way function that is easy to compute forward but practically impossible to reverse — so it checks a login by hashing what you typed and comparing. To stop attackers from precomputing hashes of common passwords, each password is also given a unique random salt mixed in before hashing, so identical passwords hash differently and a single precomputed table cannot crack them all. Multi-factor authentication combines two or more different factors (say a password plus a phone code), so that stealing just one is not enough. Crucially, authentication is distinct from authorization: authentication asks who are you, authorization asks what may you do — you authenticate once, then the system checks your authorizations on each action.

Authentication matters because it is the foundation every other control rests on — access control, auditing, and accountability all assume the system correctly knows who is acting. The honest caveats are sharp. Passwords are weak in practice: people reuse them, pick guessable ones, and get phished, which is why multi-factor is strongly recommended. Biometrics feel magical but have a hard problem — you cannot change your fingerprint if it leaks, and they can be spoofed — so they are best as one factor, not the only one. And no authentication is stronger than its recovery path: a perfect login is worthless if account recovery can be social-engineered.