Authentication is proof that someone really is the person or system they claim to be.
It is the basis of every access control: only afterwards is it decided what someone may do.
Types of Authentication
Proofs fall into three groups, the so-called factors.
Something You Know
Knowledge such as passwords, PINs or answers to security questions.
This factor is widespread but can be guessed, intercepted or stolen through phishing.
Something You Have
Possession such as a smartphone with an authenticator app, a hardware key or a smart card.
An attacker would need the device itself.
Something You Are
Biometric traits such as a fingerprint, face or iris.
They are convenient but cannot be changed once they have been copied.
Multi-Factor Authentication
Multi-factor authentication (MFA) combines at least two different factors, such as a password and a code from an app.
Benefits of Multi-Factor Authentication
A stolen password alone is no longer enough for access.
MFA prevents most automated account takeovers.
Challenges of Multi-Factor Authentication
Extra steps take time, devices get lost and attackers try to pressure users into approving with many push requests.
Good recovery paths and phishing-resistant methods such as passkeys solve many of these problems.
Authentication Protocols
Protocols define how proofs are exchanged securely between systems.
Kerberos
Kerberos works with time-limited tickets issued by a central server.
It is the basis of login in many company networks, for example with Active Directory.
Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
TLS, the successor to SSL, proves with a certificate that a server is genuine and encrypts the connection.
With client certificates, users or devices can identify themselves too.
Extensible Authentication Protocol (EAP)
EAP is a framework for different login methods in networks, for example Wi-Fi with WPA2 or WPA3 Enterprise.
It supports passwords, certificates and tokens.
CAPTCHA as an Authentication Method
A CAPTCHA does not check who someone is, but whether a human or a bot is making the request.
It therefore complements login rather than replacing it.
Benefits of CAPTCHA
On login pages, a CAPTCHA slows down automated guessing of passwords and stolen credentials.
CDPCaptcha does this without puzzles: the browser computes briefly in the background, and bots pay for every attempt.
Challenges of CAPTCHA
Picture puzzles annoy users, exclude people with disabilities and are increasingly solved by AI.
Modern methods therefore rely on invisible, accessible checks.
Conclusion
Authentication protects accounts and data from unauthorised people.
The safest approach combines several factors, complemented by protection against automated attacks.