Identity and authentication
🏠The everyday picture
At a bank counter, you prove who you are with something you know (a PIN), something you have (a card), or something you are (a fingerprint). After that, the clerk treats your requests as yours.
📘What it really is
-
Authentication answers "who are you?". Authorisation answers "what are you allowed to do?" (Module 48). They're different, and both are needed.
-
Ways to prove identity:
- something you know: a password;
- something you have: a phone receiving a one-time code, an authenticator app, a passkey on a device;
-
something you are: a fingerprint or face, usually unlocking a passkey.
-
Multi-factor authentication (MFA) combines two kinds. It stops most account takeovers even when a password leaks.
-
Passkeys replace passwords with a key stored on the person's device; there's nothing to phish or leak. They're becoming the standard.
-
Don't build it all yourself if you don't have to. Authentication is easy to get subtly wrong. Established libraries (like Better Auth or Auth.js) and services (Clerk, Auth0, Firebase Auth, Supabase Auth) handle passwords, MFA, passkeys, "sign in with Google" and recovery. Learn how it works here, so you can choose and check those tools wisely.
🖱️Try it
Sign in to an account you use (email, bank, GitHub). Find its security settings and see which methods it offers: password, one-time codes, authenticator app, passkeys. Turn on MFA for your GitHub account if it isn't on.
✅Quick check
What's the difference between authentication and authorisation?
Show the answer
Authentication checks who you are; authorisation checks what you're allowed to do.
Your password leaked, but MFA is on. Can an attacker sign in?
Show the answer
Usually not, because they also need your second factor, like a code from your phone.