身份验证因素与多因素身份验证
学习身份验证因素的三种类别，以及将它们组合成多因素身份验证如何显著提升安全性。
身份验证因素与多因素身份验证 是 CoddyKit 上的免费 OAuth2 & OpenID Connect Deep Dive 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 OAuth2 & OpenID Connect Deep Dive 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 OAuth2 & OpenID Connect Deep Dive 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Proving Who You Are
Authentication asks "are you really you?" — and answers it by checking authentication factors, pieces of evidence tied to your identity.
Three Factor Categories
Every factor fits one of three categories: something you know, something you have, or something you are.
Something You Know
Knowledge factors are secrets you remember — passwords, PINs, security answers. Cheap, but easily phished, guessed, or reused.
Something You Have
Possession factors are things you hold: a phone getting a code, a hardware key, or an authenticator app spitting out rotating codes like this one.
// TOTP code shown by an authenticator app
// changes every 30 seconds
482913Something You Are
Inherence factors are biometrics — fingerprint, face, voice. Convenient and hard to share, but you can't change them once compromised.
Single-Factor Weakness
Leaning on a single factor, usually a password, is fragile — one leak hands over full access. Most major breaches trace back to single-factor logins.
What MFA Means
Multi-factor authentication requires factors from two or more different categories. Password plus phone code is MFA; two passwords is not — both are knowledge.
Why MFA Is Stronger
MFA is stronger because an attacker must defeat several independent factors at once — stealing your password and your phone — making remote attacks far harder.
TOTP One-Time Passwords
A TOTP is a common possession factor: the server and app share a secret and both compute the same code, which rotates every 30 seconds.
// pseudo: code = HOTP(secret, floor(time / 30))
String code = totp(secret, System.currentTimeMillis());Push and Passkeys
Modern logins cut friction with push approvals on a trusted device and passkeys — combining a device (have) with biometrics (are) to resist phishing.
Adaptive Authentication
Adaptive authentication asks for extra factors only when risk spikes — a new device or odd location — balancing security against user convenience.
Quick Check
A login requires a password and a fingerprint. Why does this count as multi-factor?
Recap
Recap: the three factor categories are know, have, and are. Password-only is weak; MFA mixes categories, and TOTP, passkeys, and adaptive auth raise the bar.
常见问题解答
「身份验证因素与多因素身份验证」课时是免费的吗？
是的 — 「身份验证因素与多因素身份验证」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 OAuth2 & OpenID Connect Deep Dive 课程的其余内容，请升级到 CoddyKit PRO。 OAuth2 & OpenID Connect Deep Dive 课程共包含 4 节课。
「身份验证因素与多因素身份验证」这节课中我会学到什么？
学习身份验证因素的三种类别，以及将它们组合成多因素身份验证如何显著提升安全性。 你通过在浏览器中直接运行的动手代码来练习 OAuth2 & OpenID Connect Deep Dive，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 OAuth2 & OpenID Connect Deep Dive 需要有经验吗？
无需任何先前经验。CoddyKit 上的 OAuth2 & OpenID Connect Deep Dive 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。
「身份验证因素与多因素身份验证」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 OAuth2 & OpenID Connect Deep Dive 课中编写并运行代码吗？
能。每节 OAuth2 & OpenID Connect Deep Dive 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。