Authentication Factors & Multi-Factor Auth
Learn the three categories of authentication factors and how combining them into multi-factor authentication dramatically improves security.
Authentication Factors & Multi-Factor Auth is a free OAuth2 & OpenID Connect Deep Dive lesson on CoddyKit. This is lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the OAuth2 & OpenID Connect Deep Dive learning path, and your progress syncs across the web and the CoddyKit app. The OAuth2 & OpenID Connect Deep Dive course includes 4 lessons in total.
Proving Who You Are
Authentication asks "are you really you?" — and answers it by checking authentication factors, pieces of evidence tied to your identity.
Three Factor Categories
Every factor fits one of three categories: something you know, something you have, or something you are.
Something You Know
Knowledge factors are secrets you remember — passwords, PINs, security answers. Cheap, but easily phished, guessed, or reused.
Something You Have
Possession factors are things you hold: a phone getting a code, a hardware key, or an authenticator app spitting out rotating codes like this one.
// TOTP code shown by an authenticator app
// changes every 30 seconds
482913Something You Are
Inherence factors are biometrics — fingerprint, face, voice. Convenient and hard to share, but you can't change them once compromised.
Single-Factor Weakness
Leaning on a single factor, usually a password, is fragile — one leak hands over full access. Most major breaches trace back to single-factor logins.
What MFA Means
Multi-factor authentication requires factors from two or more different categories. Password plus phone code is MFA; two passwords is not — both are knowledge.
Why MFA Is Stronger
MFA is stronger because an attacker must defeat several independent factors at once — stealing your password and your phone — making remote attacks far harder.
TOTP One-Time Passwords
A TOTP is a common possession factor: the server and app share a secret and both compute the same code, which rotates every 30 seconds.
// pseudo: code = HOTP(secret, floor(time / 30))
String code = totp(secret, System.currentTimeMillis());Push and Passkeys
Modern logins cut friction with push approvals on a trusted device and passkeys — combining a device (have) with biometrics (are) to resist phishing.
Adaptive Authentication
Adaptive authentication asks for extra factors only when risk spikes — a new device or odd location — balancing security against user convenience.
Quick Check
A login requires a password and a fingerprint. Why does this count as multi-factor?
Recap
Recap: the three factor categories are know, have, and are. Password-only is weak; MFA mixes categories, and TOTP, passkeys, and adaptive auth raise the bar.
Frequently Asked Questions
Is the “Authentication Factors & Multi-Factor Auth” lesson free?
Yes — the full text of “Authentication Factors & Multi-Factor Auth” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the OAuth2 & OpenID Connect Deep Dive course, upgrade to CoddyKit PRO. The OAuth2 & OpenID Connect Deep Dive course includes 4 lessons in total.
What will I learn in “Authentication Factors & Multi-Factor Auth”?
Learn the three categories of authentication factors and how combining them into multi-factor authentication dramatically improves security. You practise OAuth2 & OpenID Connect Deep Dive with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start OAuth2 & OpenID Connect Deep Dive?
No prior experience is required. OAuth2 & OpenID Connect Deep Dive on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.
How long does the “Authentication Factors & Multi-Factor Auth” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this OAuth2 & OpenID Connect Deep Dive lesson?
Yes. Every OAuth2 & OpenID Connect Deep Dive lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- AuthN vs AuthZ Explained
- Evolution of Identity Management
- Basic Security Concepts & Terminology
- Authentication Factors & Multi-Factor Auth