Authentication

What is authentication in simple words

Authentication is the process of verifying a user's identity or the authenticity of a device when accessing a system, service or data. In simple words, it is the answer to the question “Prove that you really are who you claim to be”.

Imagine that you come to a bank to withdraw money. First you state your name (identification). Then you show your passport (authentication) — you prove that you are who you say you are. Only after that the cashier checks whether you can withdraw money (authorization). The same scheme works in the digital world.

Authentication is the first and most important stage of protecting any system. Without it, it is impossible to ensure data security — any attacker could impersonate another user. According to Verizon, 81% of all data breaches are related to the use of weak or compromised passwords, which emphasizes the importance of correct authentication. Read about how authentication differs from authorization in the article Authorization.

Three main authentication factors

Three main types of factors are used to verify authenticity, which can be combined to improve security:

• Knowledge factor (what you know): Password, PIN code, answer to a secret question, code word. The most common, but also the most vulnerable method, since passwords can be guessed, stolen or caught sight of.
• Possession factor (what you have): Smartphone for receiving an SMS code, authenticator application (Google Authenticator, Yandex Key), USB token (YubiKey, Rutoken), smart card or bank card.
• Biometric factor (what you are): Fingerprint, face scan (Face ID), retina scan, voice, behavioral patterns (typing dynamics).

Read about biometrics security in the article Biometrics.

Types of authentication

Depending on the number of factors used and the application scenario, authentication is divided into several types:

• Single-factor (1FA): Only one factor is used — usually a password. The simplest, but least secure method. Suitable for low-risk systems (for example, access to a news site).
• Two-factor (2FA): Two factors from different categories are used — for example, a password (knowledge) + an SMS code or push notification (possession). It blocks 99.9% of automated attacks and significantly improves security.
• Multi-factor (MFA): Three or more factors are used — for example, password + fingerprint + application code. The most reliable method, recommended for critical systems (banks, government systems).
• Passwordless authentication: Login without a password — via biometrics (Face ID, fingerprint), an email link, a one-time code via push notification or a hardware key. It is considered the most secure and convenient method, as it eliminates the risk of password theft.

Read about MFA in the article Multi-factor authentication (MFA).

How authentication works in practice

The authentication process in a typical system consists of several sequential steps:

1. Identification: The user informs the system who they are (for example, enters a login or email). This is not a check, but only an indication of identity.
2. Provision of evidence: The user enters a password, puts a finger on the scanner, enters an SMS code or confirms the login in the authenticator application.
3. Verification by the system: The system compares the provided data with what is stored in the database (password hashes, biometric templates, tokens).
4. Result: If the data matches, authentication is successful and the user gains access (usually in the form of a session token or cookie). If not, access is denied, and the system may lock the account after several failed attempts.

Modern authentication trends

Authentication is actively evolving to meet modern security and convenience requirements:

• Passwordless login: The use of biometrics, one-time links or hardware keys instead of passwords. More secure and convenient for users. In Russia it is actively being introduced in banking applications and on the State Services portal.
• Adaptive (contextual) authentication: The system analyzes the context of the login: geolocation, device, time, user behavior. If everything matches the norm, the login proceeds without additional requests; if there are suspicions, the system requests an additional factor.
• Continuous (continuous) authentication: Constant identity verification throughout the entire session, not only at login. It uses behavioral biometrics (typing dynamics, mouse movements) to detect session takeover.
• Integration with government systems: In Russia, more and more systems use ESIA (Unified Identification and Authentication System) to log in to the State Services portal and other government services, which simplifies access for citizens.

Read about protection from unauthorized access in the article Access control.