Authentication as a word and as a mechanism
To authenticate is to establish that a thing is genuine. The word comes from the Greek authentikos, originally used of texts and manuscripts to mean "original, authoritative" — the version made by the author, not a later copy or forgery. Modern usage extends the same idea to persons: authenticating a person means establishing that they are the person they present themselves as.
The mechanisms that go under the name "authentication" in digital systems do not do that. They check credentials. A credential — from the Latin credere, to believe — is something the system has been told to accept as evidence that the person presenting it is the person the account is for. The check answers a question about the credential. It does not answer a question about the person. The word promised presence. The mechanism delivers possession.
This gap is invisible in ordinary use because most of the time the person presenting the credential is the person the account is for. It becomes visible in breach reports, where roughly eighty per cent of confirmed incidents in recent Verizon Data Breach Investigations Reports involve authentication failure of one form or another. The word survives its own inaccuracy because the mechanism works most of the time and because we have no other word for what the mechanism actually does.
The three factors of authentication
The mechanisms sort into three categories. Something you know is a piece of information — a password, a passphrase, a PIN, an answer to a security question. Something you have is a token — a phone with an authenticator app, a hardware key, an SMS-capable line, a smart card. Something you are is a physical measurement — a fingerprint reading, a face scan, an iris pattern, a voiceprint.
All three categories share a property that is often observed but rarely centred in analysis. Each is separable from the human it is meant to represent. Passwords can be typed by anyone who has read them. Tokens can be lost, stolen, borrowed, or intercepted through the channel used to deliver a one-time code. Physical measurements stored as templates on a server are copies of a person, held apart from the person, capable of being extracted from the database that holds them and used against the person they were taken from.
The point holds even where the implementation appears to close the gap. Face ID on iOS, the equivalent on Android, Windows Hello on PCs — each pairs a biometric reading with a numeric fallback. If the face or fingerprint reading fails, or if the user chooses, the device asks for a PIN or a passcode instead. The biometric is a user-experience layer over the underlying credential; the security of the system is bounded by whatever the fallback is. A biometric is not a substitute for a password on a device that keeps a password around in case the biometric does not work. It is a convenience wrapper around the password. Anyone who acquires the password — by observation, coercion, or the routine channels that leak passwords — bypasses the biometric entirely, because the system was designed to let them.
Separability is a foundational property, not an implementation detail. A thing that can be held apart from the person is a thing that, once held apart, no longer answers a question about the person. It answers a question about itself.
Multi-factor layering
The industry response to the separability problem has been layering. Two factors instead of one. Three factors instead of two. Adaptive risk scoring, step-up prompts, phishing-resistant hardware keys, out-of-band confirmation. The reasoning is that if any single proxy for the person is separable, combining several proxies raises the difficulty of the attacker acquiring all of them at once.
The reasoning is correct. What it accomplishes is a rise in the cost, complexity, and inconvenience of an attack, and, correspondingly, an increase in the probability that a given authentication event was genuine. What it does not accomplish is certainty. The Colonial Pipeline breach in May 2021 succeeded through a single leaked password on an account with no second factor. The MGM Resorts breach in September 2023 succeeded through a phone call to a help desk that reset a working second factor. The Snowflake customer breaches in 2024 succeeded against accounts that had no MFA enrolment at all, using credentials harvested from unrelated infostealer infections. Each of these attackers walked around the layering rather than through it. Each of them found a separable proxy in the stack and acquired it.
Identity is binary. Either the system knows, at the moment of an action, which specific human is taking the action, or it does not. No layer count changes that binary. A layer count changes the probability that the answer is right. Layering is an honest accommodation for uncertainty that cannot, at the mechanism level, be eliminated.
The user pays the cost of the layering in friction. The organisation pays the cost in engineering and support. The bad actor pays the cost in effort. The bet, at every tier of layering, is that the value of what is protected does not justify the effort. The bet fails often enough that regulation and insurance regimes exist alongside authentication itself.
Authentication and identity
The concept of authentication as a discrete step is an artefact. It exists because the systems that transport a user's actions to a service cannot, on their own, tell the service whose actions those are. Something must be introduced at the moment of the action to close that gap: a credential to be checked, a factor to be verified, a challenge to be responded to.
If the identity problem were resolved at the moment of the action — if a specific human were knowably present at the moment a specific request was made — the reason for authentication as a separate step would go with it. There would be no proxy to check, because the binding between the human and the action would not have been broken in the first place. The mechanism that today produces a credential to be checked would produce, instead, an attestation that a specific person was present. Authentication would collapse into identity, in the same way that signing collapses into identity when the substrate of the signature stops being the thing that carries the meaning.
The research question is what a system architected on that principle looks like. Not what it protects against, or what it enables, or what its user experience becomes: those are consequences downstream of the theoretical claim. The claim is that authentication, as a discrete concept, is a symptom of an identity architecture in which the person is not the primary thing being tracked. Once the person is the primary thing being tracked, the symptom disappears.
