Cybersecurity Foundations (Grades 6–8) · lesson 47 of 48 · 8 min
Authentication: The Gatekeeper of Every System
Authentication is the process that decides who gets in. Every time you log into a website, unlock your phone, or access a school system, authentication is running. It is one of the most attacked components of any system — because if an attacker can authenticate as you, they have everything you have access to.
This lesson brings together everything you have learned about authentication throughout the pathway — passwords, MFA, biometrics, passkeys — into a comprehensive review that deepens your technical understanding and prepares you for the capstone.
By the end of this lesson you will be able to distinguish identification, authentication, and authorisation, explain the three authentication factors, compare authentication methods by security level, and understand modern attacks like credential stuffing and MFA fatigue.
Authentication is the most attacked component
According to Verizon’s Data Breach Investigations Report, over 80% of breaches involve compromised credentials. Attackers do not need to break encryption or exploit zero-days if they can simply log in with stolen credentials. Strengthening authentication — with strong passwords, MFA, and eventually passkeys — is the single highest-impact security improvement most people can make.
Authentication — The Full Picture
You have encountered authentication concepts throughout this pathway. This lesson brings them together into a comprehensive review, deepens your understanding of how authentication works technically, and prepares you for the capstone lesson.
Authentication is the process of proving you are who you claim to be. It is distinct from authorisation (what you are allowed to do once authenticated) and identification (claiming an identity, like entering a username).
Key Concepts
Authentication Factors
MFA strength
Multi-factor authentication combines two or more factors from different categories. A password (knowledge) + TOTP code (possession) is strong MFA. A password + security question is weak MFA — both are knowledge factors. True MFA uses factors from different categories.
Authentication Attack Methods
Passwordless Authentication
The future of authentication is moving away from passwords entirely. Passkeys (based on the FIDO2/WebAuthn standard) replace passwords with cryptographic key pairs. Your device holds a private key; the website holds a public key. Authentication happens by signing a challenge with your private key — no password is ever transmitted or stored.
Passkeys are phishing-resistant (there is no password to steal), cannot be credential-stuffed (each passkey is site-specific), and are more convenient than passwords.
Knowledge Check
Authentication Review
What is the difference between authentication and authorisation?
- They are the same thing
- Authentication proves who you are; authorisation determines what you can do
- Authorisation proves who you are; authentication determines what you can do
- Authentication is for humans; authorisation is for machines
Answer: Authentication proves who you are; authorisation determines what you can do
Authentication verifies identity. Authorisation grants permissions based on that identity. Both are required for secure access control.
A password combined with a security question is an example of weak MFA. Why?
- Security questions are too long
- Both factors are knowledge factors — true MFA uses factors from different categories
- Security questions are not supported by most websites
- Passwords and security questions use different encryption
Answer: Both factors are knowledge factors — true MFA uses factors from different categories
True MFA combines factors from different categories (knowledge + possession, or knowledge + inherence). Two knowledge factors can both be phished or guessed.
What is credential stuffing?
- Trying every possible password combination
- Using username/password pairs from data breaches to attack other sites
- Stealing password hashes from a database
- Sending repeated MFA push notifications
Answer: Using username/password pairs from data breaches to attack other sites
Credential stuffing exploits password reuse. If you use the same password on multiple sites, one breach compromises all of them.
Why are passkeys considered phishing-resistant?
- They are too long to type into a fake site
- They are site-specific cryptographic keys — there is no password to steal or enter on a fake site
- They require biometric authentication
- They expire after 30 seconds
Answer: They are site-specific cryptographic keys — there is no password to steal or enter on a fake site
Passkeys are bound to a specific domain. Even if you visit a fake site, the passkey will not work there — and there is no password for the attacker to capture.
An attack that sends repeated MFA push notifications hoping the user approves one out of frustration is called MFA _____.
Answer: fatigue
MFA fatigue (or push bombing) exploits the human tendency to approve notifications to make them stop. Defences include number matching and using FIDO2 hardware keys.
Real-World Case Studies
Case 1: The Uber Hack — MFA Fatigue in Action
In September 2022, an 18-year-old hacker breached Uber’s internal systems. The attack started with credential stuffing — the attacker bought Uber employee credentials from the dark web. The employee had MFA enabled, so the attacker sent repeated MFA push notifications for over an hour. The employee eventually approved one, thinking it was a glitch. The attacker then gained access to Uber’s internal systems, Slack, and AWS. The lesson: MFA fatigue is a real attack. Defences include number matching (the app shows a number you must match), and using FIDO2 hardware keys that are phishing-resistant by design.
Case 2: The FIDO2 Passkey Revolution
In 2022–2023, Apple, Google, and Microsoft all added passkey support to their platforms. Passkeys replace passwords with cryptographic key pairs — your device holds the private key, the website holds the public key. There is no password to steal, no phishing page that can capture it, and no server-side password database to breach. Early adoption data shows passkeys are 8x faster to use than passwords and have a near-zero phishing success rate. The lesson: passkeys represent the most significant improvement in consumer authentication security in decades. Learning about them now prepares you for the authentication landscape of the next decade.
Previous lesson: Encryption in everyday life
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Cyber defender capstone