🔑

Authentication Methods Cheat Sheet

Passwords, MFA, biometrics, and SSO protocols

🔌 Network Ports 📚 OSI Model 🧮 Subnetting 🔢 IPv4 vs IPv6 🛜 Routing Protocols

Method	Category	Security	Pros	Cons
Password	Something You Know	Low	Simple, universal	Weak, reusable, phishable
PIN	Something You Know	Low	Quick entry	Short, brute-forceable
Security Questions	Something You Know	Very Low	Fallback option	Easily researched, weak
TOTP	Something You Have	Good	Time-based, offline	Codes expire quickly
HOTP	Something You Have	Good	Counter-based	Sync issues possible
SMS OTP	Something You Have	Moderate	No app needed	SIM swapping, SS7 attacks
Email OTP	Something You Have	Moderate	No app needed	Email compromise risk
Push Notification	Something You Have	Good	Easy, one-tap approve	Push fatigue attacks
Hardware Token	Something You Have	Excellent	Phishing-resistant	Cost, can be lost
FIDO2/WebAuthn	Something You Have	Excellent	Phishing-proof, no secrets	Device-bound
Passkeys	Something You Have	Excellent	Synced, phishing-proof	New standard adoption
Smart Card	Something You Have	Excellent	PKI-based, strong	Requires reader
Fingerprint	Something You Are	Good	Convenient, fast	Spoofable, unchangeable
Facial Recognition	Something You Are	Good	Hands-free	Lighting, masks, twins
Iris Scan	Something You Are	Excellent	Very unique pattern	Expensive, intrusive
Voice Recognition	Something You Are	Moderate	Hands-free	Spoofable with recordings
MFA (2FA)	Multi-Factor	Very Good	Combines factors	User friction
Adaptive/Risk-Based	Contextual	Dynamic	Context-aware	Complex to implement
SSO	Federated	Depends on IdP	Single login	Single point of failure
OAuth 2.0	Authorization	Standard	Delegated access	Complex flows
SAML	Federated	Good	Mature, XML-based	Verbose, complex
OIDC	Federated	Good	JSON/JWT, simpler	OAuth extension

🛡️ Three Authentication Factors

Something You Know: Password, PIN

Something You Have: Token, phone, smart card

Something You Are: Fingerprint, face, iris