AP® Computer Science Principles · Big Idea 5 · Topic 5.6
Authentication and Multifactor Authentication
Authentication proves you are who you claim to be, usually by checking a password against a stored value. Multifactor authentication adds independent proofs, like a code on your phone, so a stolen password alone can't get an attacker in.
A password is one proof among several possible kinds. Security people sort proofs into three categories: something you know, like a password or PIN, something you have, like a phone or a key fob, and something you are, like a fingerprint or your face. Each category is a separate wall. A thief who steals your password has climbed the knowledge wall, but multifactor authentication makes them also climb the possession or inherence wall, which stealing a password does nothing for. That is why a stolen password stops being enough: the account no longer opens on knowledge alone.
Passwords work by making guessing expensive. If a password uses n possible characters at each of k positions, the number of possible passwords is n to the power k, and an attacker who can't see the password has to search through that space. Growing k even a little causes huge growth, because the exponent multiplies rather than adds. This is why length matters so much more than people expect, and why a long, dumb-looking passphrase can beat a short clever one.
Strength is about unpredictability, not appearance. A password that looks complicated but follows a guessable pattern, like a dictionary word with a capital letter and a digit tacked on, lives in a tiny, well-known corner of the full possibility space, so attackers check that corner first. This connects to the bigger unit theme: authentication is one of the main defenses protecting the private data that flows through networks, sitting alongside encryption as a way computing tries to keep information from falling into the wrong hands.
Key terms
- Authentication
- The process of proving that a user is who they claim to be before granting access.
- Multifactor authentication
- Requiring two or more independent proofs of identity, such as a password plus a phone code.
- Knowledge factor
- A proof based on something only the user should know, like a password or PIN.
- Possession factor
- A proof based on something the user physically has, like a phone or security key.
- Inherence factor
- A proof based on a physical trait of the user, like a fingerprint or face scan.
Watch it explained
Check yourself
End of topic.