Authentication Factors & Multi-Factor Auth
Learn the three categories of authentication factors and how combining them into multi-factor authentication dramatically improves security.
Authentication Factors & Multi-Factor Auth is a free OAuth2 & OpenID Connect Deep Dive lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the OAuth2 & OpenID Connect Deep Dive learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Proving Who You Are
Authentication asks "are you really you?" — and answers it by checking authentication factors, pieces of evidence tied to your identity.
Three Factor Categories
Every factor fits one of three categories: something you know, something you have, or something you are.
Something You Know
Knowledge factors are secrets you remember — passwords, PINs, security answers. Cheap, but easily phished, guessed, or reused.
Something You Have
Possession factors are things you hold: a phone getting a code, a hardware key, or an authenticator app spitting out rotating codes like this one.
// TOTP code shown by an authenticator app
// changes every 30 seconds
482913Something You Are
Inherence factors are biometrics — fingerprint, face, voice. Convenient and hard to share, but you can't change them once compromised.
Single-Factor Weakness
Leaning on a single factor, usually a password, is fragile — one leak hands over full access. Most major breaches trace back to single-factor logins.
What MFA Means
Multi-factor authentication requires factors from two or more different categories. Password plus phone code is MFA; two passwords is not — both are knowledge.
Why MFA Is Stronger
MFA is stronger because an attacker must defeat several independent factors at once — stealing your password and your phone — making remote attacks far harder.
TOTP One-Time Passwords
A TOTP is a common possession factor: the server and app share a secret and both compute the same code, which rotates every 30 seconds.
// pseudo: code = HOTP(secret, floor(time / 30))
String code = totp(secret, System.currentTimeMillis());Push and Passkeys
Modern logins cut friction with push approvals on a trusted device and passkeys — combining a device (have) with biometrics (are) to resist phishing.
Adaptive Authentication
Adaptive authentication asks for extra factors only when risk spikes — a new device or odd location — balancing security against user convenience.
Quick Check
A login requires a password and a fingerprint. Why does this count as multi-factor?
Recap
Recap: the three factor categories are know, have, and are. Password-only is weak; MFA mixes categories, and TOTP, passkeys, and adaptive auth raise the bar.
Frequently asked questions
Is the “Authentication Factors & Multi-Factor Auth” lesson free?
Yes — the full text of “Authentication Factors & Multi-Factor Auth” is free to read here on the web, and the OAuth2 & OpenID Connect Deep Dive course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the OAuth2 & OpenID Connect Deep Dive course, upgrade to CoddyKit PRO.
What will I learn in “Authentication Factors & Multi-Factor Auth”?
Learn the three categories of authentication factors and how combining them into multi-factor authentication dramatically improves security. You practise OAuth2 & OpenID Connect Deep Dive with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start OAuth2 & OpenID Connect Deep Dive?
No prior experience is required. OAuth2 & OpenID Connect Deep Dive on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Authentication Factors & Multi-Factor Auth” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this OAuth2 & OpenID Connect Deep Dive lesson?
Yes. Every OAuth2 & OpenID Connect Deep Dive lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- AuthN vs AuthZ Explained
- Evolution of Identity Management
- Basic Security Concepts & Terminology
- Authentication Factors & Multi-Factor Auth