Authentication Factors
Something you know, have, are.
Authentication Factors is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is Authentication?
Authentication is proving you are who you claim to be.
Strong authentication relies on combining different factors, each a distinct kind of proof.
The Three Factor Types
Authentication factors fall into three categories:
- Something you know (a password or PIN)
- Something you have (a phone or security key)
- Something you are (a fingerprint or face)
Knowledge Factors
Knowledge factors are secrets you remember: passwords, PINs, and security questions.
They are cheap and familiar but easily phished, guessed, or reused across sites.
Possession Factors
Possession factors are things you physically hold:
- A phone receiving a code or push
- A hardware security key
- A smart card
An attacker must steal the device to use it.
Inherence Factors
Inherence factors are biometric: fingerprints, face, iris, or voice.
They are convenient and hard to forget, but cannot be changed if compromised, so they are best used as one factor among several.
What Makes It Multi-Factor
Multi-Factor Authentication (MFA) requires factors from different categories.
A password plus a PIN is not MFA, because both are knowledge factors. A password plus a phone code is.
Why One Factor Is Not Enough
Passwords alone are the weakest link: they are reused, phished, and leaked in breaches.
Adding a second factor means a stolen password is no longer enough to log in.
Two-Factor vs Multi-Factor
Two-Factor Authentication (2FA) is MFA with exactly two factors.
MFA is the broader term and can require two or more. In practice, most consumer systems use 2FA.
Common Second Factors
Typical second factors, from weakest to strongest:
- SMS codes (vulnerable to SIM swapping)
- Authenticator app codes (TOTP)
- Push approvals
- Hardware security keys (strongest)
Adaptive Authentication
Modern systems use adaptive (risk-based) authentication: extra factors are only required when the login looks risky.
Signals include a new device, unusual location, or impossible travel.
Location and Behavior
Some systems treat location (somewhere you are) or behavior (typing rhythm) as additional signals.
These are usually risk inputs rather than standalone factors, but they strengthen the overall decision.
Quick Check
Which of these combinations qualifies as true multi-factor authentication?
Recap
You learned the three authentication factor categories: know, have, and are.
- True MFA mixes factors from different categories.
- Second factors range from weak SMS to strong hardware keys.
- Adaptive auth adds factors only when risk is high.
Next, we dig into how one-time password algorithms work.
Frequently asked questions
Is the “Authentication Factors” lesson free?
Yes — the full text of “Authentication Factors” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Authentication Factors”?
Something you know, have, are. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Authentication Factors” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Authentication Factors
- TOTP and HOTP
- Push and Hardware Keys
- MFA Bypass Risks