Authentication Explained: Passwords, MFA, Passkeys, Sessions, and Federation

Authentication Explained: Passwords, MFA, Passkeys, Sessions, and Federation

Authentication verifies who or what is trying to access a system. It is separate from authorization, which decides what that authenticated identity may do.

Common Authentication Methods

Passwords

Still widely used, but they must be stored with slow password hashing and protected against credential stuffing, brute force, and weak recovery flows.

Multi-Factor Authentication

MFA combines independent factors such as something the user knows and something they possess.

OTP/SMS methods improve security over passwords alone, but manually entered codes are still phishable.

Passkeys and Security Keys

FIDO/WebAuthn-style cryptographic authenticators bind authentication to the legitimate site and provide phishing resistance. Current NIST SP 800-63B-4 explicitly distinguishes phishing-resistant cryptographic authentication from manually entered OTP/out-of-band codes.

Federated Authentication

Protocols such as OpenID Connect let an application rely on an identity provider instead of directly managing every user's primary authentication credentials.

OAuth alone is an authorization framework; OpenID Connect adds standardized authentication/identity semantics.

Authentication Produces a Session

After successful authentication, the application still needs a secure way to remember the identity:

Rendering diagram…

That may be a server-side browser session, an access token, or another protocol-specific credential. Session/token security is part of the authentication architecture.

Re-Authenticate Sensitive Actions

Changing a password, disabling MFA, adding recovery methods, or performing a high-risk transaction may require fresh authentication rather than trusting a very old session.

Recovery Is Part of Authentication

An excellent login flow with a weak password/MFA recovery process is still a weak authentication system. Recovery proof should be at least proportionate to the account's risk and should generate security notifications where appropriate.

Final Takeaway

Authentication is a lifecycle, not one login form: enrollment, authenticators, verification, MFA/passkeys, sessions, federation, recovery, and re-authentication all need a coherent security model.

References

• NIST SP 800-63B-4: Authentication and Authenticator Management
• OWASP Authentication Cheat Sheet
• OWASP Multifactor Authentication Cheat Sheet