Authentication: Prove Who You Are

A login screen looks simple: username, password, submit.

Behind that screen is a security decision.

Should this person be trusted with access to this account, device, file, or service?

Authentication is the process used to answer that question. It does not prove that a person is good, careful, or authorized to do everything inside the system. It proves that the person satisfied the system's chosen identity check.

That distinction matters.

Identification is not authentication

A username says who you claim to be.

Authentication asks for evidence that supports the claim.

If you type student42, the system now knows which identity you are claiming. It still needs a way to verify that claim.

Common authentication factors are usually grouped into three categories:

• Something you know: password, PIN, passphrase
• Something you have: phone, hardware token, security key
• Something you are: fingerprint, face, other biometric

Using two different factors can create multi-factor authentication, or MFA.

Two passwords are not two factors. A password and a PIN are both "something you know."

Concept flow

Authentication is a chain of claims and checks

A username identifies an account. Authentication factors provide evidence. Authorization decides what an authenticated identity may do.

1. IDENTITY CLAIMI am student@example
   prove with
2. FACTOR 1something you know, such as a password
   strengthen with
3. FACTOR 2something you have or are
   establishes
4. AUTHENTICATED IDENTITYthe system has enough evidence to accept the claim
   then
5. AUTHORIZATIONpermissions decide which actions are allowed

The flow above separates three ideas students often collapse into one: identifying an account, proving the identity claim, and deciding what the authenticated identity is allowed to do.

What makes a password strong?

A password is useful when it is difficult for someone else to guess, reuse, or discover.

Length matters. Uniqueness matters. Predictability matters.

Compare these fictional examples:

• Robotnix123
• Mths2026!
• roboticsrobotics
• violet-harbor-lantern-orbit

Do not treat this as a contest to count symbols. A short predictable password can contain uppercase letters, numbers, and punctuation and still be weak because the pattern is easy to guess.

A longer passphrase made from unrelated words can be much harder to guess while still being easier to remember.

The most important rule for this course is simple:

Never enter a real password into a classroom worksheet, demo tool, screenshot, or public password checker. Use only teacher-provided samples or invented examples.

Password reuse creates a second problem

Imagine a student uses the same password on three services.

One service is breached. The attacker now has a credential pair that may work somewhere else.

The weakness is no longer just the original breach. Reuse turns one exposed credential into a possible path to other accounts.

A unique password limits that blast radius.

Authentication is a system, not a password rule

A secure login can include more than the password itself:

1. user identifies the account
2. system verifies a credential
3. system may request a second factor
4. system records a successful or failed attempt
5. system may limit repeated failures
6. system may notify the user about unusual activity
7. system provides a recovery process

Each step creates a design decision.

For example, a very strong password does not help if account recovery lets anyone reset it with easily guessed information.

Analyze four fictional accounts

Use this table:

For each account:

• identify the strongest design choice
• identify the weakest design choice
• explain which CIA property could be affected if the account is compromised
• recommend one improvement

Do not write "make the password stronger" unless you explain what that means and why it addresses the specific weakness.

Worked case: the shared robotics account

A robotics team uses one shared account for its competition repository. Everyone knows the password because the team wants setup to be fast.

What is wrong with this design?

Several things:

• the password cannot be tied to one person
• removing access from one former member requires changing the shared credential for everyone
• one phishing mistake can expose access for the whole team
• audit logs may show the shared account but not which person performed the action

The authentication problem is not just password strength. It is identity and accountability.

A stronger design would use individual accounts, unique credentials, MFA, and role-based access.

Build an authentication decision tree

Create a decision tree for a fictional school service.

Your tree should answer:

1. What identity is the user claiming?
2. What first factor verifies the user?
3. Is a second factor required?
4. What happens after repeated failed attempts?
5. What evidence is recorded?
6. How can the user recover access?
7. Which recovery step could become the weakest link?

Then label each branch with the security property it helps protect.

Example:

Repeated-failure rate limiting mainly helps protect confidentiality and integrity by making large numbers of password guesses harder.

Test the design, not a real account

Use these synthetic events:

• five failed logins from the same device
• successful password followed by failed second factor
• successful login from a normal classroom device
• password reset requested immediately after several failed logins

For each event, write:

• what the authentication system should do
• what should be logged
• whether the event proves compromise
• what additional evidence would be useful

Evidence for Lesson 1

Submit:

• your four-account comparison
• your authentication decision tree
• your analysis of the four synthetic login events

Finish with this statement:

The authentication weakness that is easiest to miss is ________, because ________.

Authentication is not about making login annoying. It is about building enough confidence in identity to make an access decision without pretending any single factor is perfect.