Authentication — proving who you are

Authentication answers the question "are you really who you claim to be?" It is the front door to almost every system, and — because attackers know that — it is one of the most attacked surfaces in all of security.

Passwords, done right

The password is still the default, and storing it correctly is non-negotiable (recall the Hashing lesson). A system must never store your actual password. It stores a hash, and it hashes what you type at login to compare. But a plain fast hash is not enough:

• Salt every password with a unique random value, so identical passwords get different hashes and precomputed "rainbow tables" fail.
• Use a deliberately slow password hash — bcrypt, scrypt or Argon2 — so an attacker who steals the database can only test a few thousand guesses per second, not billions.

The hash-avalanche widget below shows the one-way, avalanching behaviour that makes this possible: from a stored hash, the password can't be recovered.

Something you know, have, and are

Passwords alone are weak — they get phished, reused and leaked. Multi-factor authentication (MFA) adds independent factors so a stolen password isn't enough:

• Something you know — a password or PIN.
• Something you have — a phone with an authenticator app, or a hardware security key.
• Something you are — a fingerprint or face scan.

Requiring two different factors blocks the overwhelming majority of account takeovers, because an attacker rarely has both. Hardware security keys (FIDO2/ passkeys) go further by being unphishable — they cryptographically bind the login to the real site, so a fake page can't relay it.

Staying logged in: sessions and tokens

Authentication happens once, but you stay logged in across many requests. After login, the server issues a session token (often in a cookie) or a signed token that your browser sends with each request to prove it's still you. That token is now as powerful as your password, so it must be:

• kept secret (sent only over TLS, marked HttpOnly so scripts can't read it);
• expired and rotated, so a stolen token doesn't work forever;
• invalidated on logout and on password change.

Stealing or forging these tokens is a favourite attacker goal — which is a perfect segue to the ways attackers get in when the authentication itself is sound: flaws in the application. That's web vulnerabilities, next.