Understand authentication factors

Editorial update: 21 September 2026. Introductory learning material.

MFA combines different factor types: knowledge, possession and, in suitable implementations, biometrics. A username is an identifier, and a password plus a security question is still the same factor type.

A passkey can use possession of a cryptographic credential together with local PIN or biometric verification. The exact assurance depends on the implementation, configuration and recovery process.

Distinguish phishing-resistant methods from codes or prompts that a user can be tricked into relaying or approving. No authentication method makes endpoint protection, session security or recovery safeguards unnecessary.

Activity: Ask your identity-service owner to identify the actual factors and recovery path used by a critical account.

Reference: FIDO Alliance passkey guidance. Check the source and your system provider’s current instructions before implementation.