Cybersecurity Foundations (Grades 9–12) · lesson 5 of 7 · 12 min
Authentication factors Authentication proves you are who you claim to be. Factors fall into three categories: Something you know: password, PIN, security question. Weakest factor — can be guessed, phished, or leaked. Something you have: hardware token, authenticator app, smart card. Stronger — requires physical possession. Something you are: fingerprint, face scan, retina. Biometrics — convenient but cannot be changed if compromised. Multi-factor authentication (MFA) MFA requires two or more factors from different categories. A password + SMS code is technically MFA but weak because SMS can be SIM-swapped. A password + TOTP authenticator app is much stronger. A hardware key (FIDO2/WebAuthn) is the strongest common option. Authentication vs. authorization Authentication answers “who are you?” Authorization answers “what are you allowed to do?” They are separate steps — a valid login does not automatically grant access to everything.
Authentication factors quiz
A user logs in with a password and then approves a push notification on their phone. How many factors are used?
- One factor (password only)
- Two factors (know + have)
- Two factors (know + are)
- Three factors
Answer: Two factors (know + have)
Password = something you know. Phone approval = something you have. That is two-factor authentication.
Why is SMS-based MFA weaker than an authenticator app?
- SMS codes expire faster
- SMS can be intercepted via SIM swapping or SS7 attacks
- Authenticator apps require biometrics
- SMS does not count as a second factor
Answer: SMS can be intercepted via SIM swapping or SS7 attacks
Attackers can convince a carrier to transfer your phone number (SIM swap) or exploit SS7 protocol weaknesses to intercept SMS codes.
Previous lesson: Risk, vulnerability, and threat
Back to Cybersecurity Foundations (Grades 9–12)
Next lesson: Password hashing and storage