CompTIA Security+ Preparation · lesson 9 of 45 · 25 min
Authentication Factors
Authentication verifies that a user is who they claim to be. The three classic factors are:
Something you know — knowledge factor. Password, PIN, security question, passphrase. Weakest factor — can be guessed, stolen, or phished.
Something you have — possession factor. Smart card, hardware token (YubiKey), TOTP app (Google Authenticator), SMS code, push notification. Can be lost or stolen.
Something you are — inherence factor. Biometrics: fingerprint, facial recognition, iris scan, voice recognition, behavioral biometrics. Cannot be forgotten but can be spoofed.
Somewhere you are — location factor. GPS location, IP address geolocation. Used as an additional factor.
Something you do — behavioral factor. Typing rhythm, mouse movement patterns. Continuous authentication.
Multi-Factor Authentication (MFA)
MFA requires two or more factors from different categories. Using two passwords is NOT MFA — they are both “something you know.”
TOTP (Time-based One-Time Password) — generates a 6-digit code that changes every 30 seconds. Based on a shared secret and the current time. RFC 6238. Used by Google Authenticator, Authy, Microsoft Authenticator.
HOTP (HMAC-based OTP) — counter-based OTP. Increments with each use rather than time-based.
Push notification MFA — sends an approval request to a registered mobile app. User taps “Approve.” Vulnerable to MFA fatigue attacks (spamming push notifications).
Hardware tokens — physical devices (YubiKey, RSA SecurID) that generate OTPs or use challenge-response. Most phishing-resistant.
FIDO2/WebAuthn — phishing-resistant authentication standard. Uses public key cryptography. The private key never leaves the device. Passkeys are based on FIDO2.
MFA Fatigue Attack
Attackers spam push notification MFA requests hoping the user approves one out of frustration. Mitigation: use number matching (user must enter a number shown on the login screen), or switch to FIDO2/passkeys which are phishing-resistant by design.
Key Terms
Key Terms
Knowledge Check — 12 Questions
Security+ — Authentication Factors & MFA
Using a password AND a PIN is:
- MFA — two factors
- Not MFA — both are “something you know”
- Two-factor authentication
- Strong authentication
- Answer: Not MFA — both are “something you know”
MFA requires factors from DIFFERENT categories. Password + PIN are both knowledge factors — this is single-factor authentication.
A fingerprint is which type of authentication factor?
- Something you know
- Something you have
- Something you are
- Somewhere you are
Answer: Something you are
Biometrics (fingerprint, face, iris) are inherence factors — “something you are.”
TOTP codes change every:
- 10 seconds
- 30 seconds
- 60 seconds
- 5 minutes
- Answer: 30 seconds
TOTP (RFC 6238) generates a new 6-digit code every 30 seconds based on the shared secret and current Unix timestamp.
Which MFA method is most resistant to phishing?
- SMS codes
- Push notifications
- TOTP apps
- FIDO2/WebAuthn hardware keys
Answer: FIDO2/WebAuthn hardware keys
FIDO2 uses public key cryptography bound to the specific website — phishing sites cannot intercept or replay the authentication.
An MFA fatigue attack involves:
- Stealing the user’s password
- Spamming push notification MFA requests hoping the user approves one
- Brute forcing TOTP codes
- Cloning a smart card
- Answer: Spamming push notification MFA requests hoping the user approves one
Attackers send dozens of push notifications — frustrated users sometimes approve one just to stop the notifications.
A YubiKey is an example of which authentication factor?
- Something you know
- Something you have
- Something you are
- Somewhere you are
Answer: Something you have
A YubiKey is a physical hardware token — a possession factor (“something you have”).
Passkeys are based on the FIDO2/WebAuthn standard.
- True
- False
Answer: True
Passkeys use FIDO2/WebAuthn — they use device-bound public key cryptography and are phishing-resistant by design.
HOTP differs from TOTP in that:
- HOTP is time-based
- HOTP is counter-based — increments with each use
- HOTP uses biometrics
- HOTP requires internet access
- Answer: HOTP is counter-based — increments with each use
HOTP (HMAC-based OTP) uses a counter that increments with each authentication. TOTP uses the current time. Number matching in push notification MFA mitigates:
- Password theft
- MFA fatigue attacks
- Biometric spoofing
- Replay attacks
- Answer: MFA fatigue attacks
Number matching requires the user to enter a number shown on the login screen — accidental approvals of spam notifications are prevented.
Which factor is “somewhere you are”?
- Password
- Smart card
- Fingerprint
- GPS location or IP geolocation
Answer: GPS location or IP geolocation
Location factors use GPS coordinates or IP geolocation to verify the user is in an expected location.
The weakness of biometric authentication is:
- Users forget their biometrics
- Biometrics can be spoofed and cannot be changed if compromised
- Biometrics require internet access
- Biometrics are too slow
- Answer: Biometrics can be spoofed and cannot be changed if compromised
If a fingerprint is compromised, you cannot change it like a password. High-quality fakes can also spoof some biometric systems.
In FIDO2, the private key _____ leaves the authenticator device.
Answer: never
FIDO2’s key security property: the private key is generated on and never leaves the authenticator device — it cannot be phished or stolen remotely.
Previous lesson: Hashing algorithms: MD5, SHA-1, SHA-256, HMAC, digital signatures
Back to CompTIA Security+ Preparation
Next lesson: Authorization models: DAC, MAC, RBAC, ABAC, rule-based access control