🔑
Authentication Methods Cheat Sheet
Passwords, MFA, biometrics, and SSO protocols
| Method | Category | Security | Pros | Cons |
|---|---|---|---|---|
| Password | Something You Know | Low | Simple, universal | Weak, reusable, phishable |
| PIN | Something You Know | Low | Quick entry | Short, brute-forceable |
| Security Questions | Something You Know | Very Low | Fallback option | Easily researched, weak |
| TOTP | Something You Have | Good | Time-based, offline | Codes expire quickly |
| HOTP | Something You Have | Good | Counter-based | Sync issues possible |
| SMS OTP | Something You Have | Moderate | No app needed | SIM swapping, SS7 attacks |
| Email OTP | Something You Have | Moderate | No app needed | Email compromise risk |
| Push Notification | Something You Have | Good | Easy, one-tap approve | Push fatigue attacks |
| Hardware Token | Something You Have | Excellent | Phishing-resistant | Cost, can be lost |
| FIDO2/WebAuthn | Something You Have | Excellent | Phishing-proof, no secrets | Device-bound |
| Passkeys | Something You Have | Excellent | Synced, phishing-proof | New standard adoption |
| Smart Card | Something You Have | Excellent | PKI-based, strong | Requires reader |
| Fingerprint | Something You Are | Good | Convenient, fast | Spoofable, unchangeable |
| Facial Recognition | Something You Are | Good | Hands-free | Lighting, masks, twins |
| Iris Scan | Something You Are | Excellent | Very unique pattern | Expensive, intrusive |
| Voice Recognition | Something You Are | Moderate | Hands-free | Spoofable with recordings |
| MFA (2FA) | Multi-Factor | Very Good | Combines factors | User friction |
| Adaptive/Risk-Based | Contextual | Dynamic | Context-aware | Complex to implement |
| SSO | Federated | Depends on IdP | Single login | Single point of failure |
| OAuth 2.0 | Authorization | Standard | Delegated access | Complex flows |
| SAML | Federated | Good | Mature, XML-based | Verbose, complex |
| OIDC | Federated | Good | JSON/JWT, simpler | OAuth extension |
🛡️ Three Authentication Factors
Something You Know: Password, PIN
Something You Have: Token, phone, smart card
Something You Are: Fingerprint, face, iris