Authentication is the process of verifying that a person actually is who they claim to be, before granting them access to a system or account. A password answering that question is only one specific method among several genuinely different categories: something a person knows, like a password; something a person has, like a physical device or security token; and something a person is, a biometric trait like a fingerprint. Modern identity management increasingly combines more than one of these categories together, precisely because relying on just one leaves a real, exploitable single point of failure.
Each authentication factor can be compromised in its own distinct way
A password, something a person knows, can be guessed, stolen through a data breach, or handed over voluntarily under a phishing attack, without the legitimate account holder's device or physical presence ever being involved at all. A physical possession factor, like a hardware security key or a code sent to a registered device, can be lost, stolen, or intercepted through its own separate attack methods. A biometric factor carries its own distinct risks too, since a compromised biometric credential, unlike a password, can't simply be changed afterward the way a leaked password can. Each category is vulnerable to genuinely different kinds of attack, which is exactly the insight that drives multi-factor authentication.
Combining factors from different categories closes gaps a single factor leaves open
Multi-factor authentication requires a person to successfully verify their identity through more than one of these categories at once, typically something they know alongside something they have. Because a successful attack against one factor category, stealing a password through a data breach, for instance, doesn't automatically grant an attacker the separate physical device or biometric trait needed to satisfy the other required factor, requiring multiple independent factors together substantially raises the difficulty of a successful unauthorised access attempt compared with relying on any single factor alone, even a strong one.
What we're still unsure about
The basic categorisation of authentication factors, and multi-factor authentication's demonstrated effectiveness at reducing successful unauthorised access, are well established, extensively studied cybersecurity practice. What remains more genuinely an active area of ongoing design debate is how to balance stronger multi-factor requirements against real usability costs, since additional authentication steps that feel excessively burdensome can push users toward workarounds that quietly undermine the added security, like disabling a factor or reusing recovery codes insecurely — security researchers and product designers continue to study how to design multi-factor systems that people will actually use correctly and consistently, rather than treating stronger security and good usability as automatically compatible.
This sits inside Authentication & Identity Management, one of seven topics in Cybersecurity, one of seven domains in Computer Science, one of seventeen subjects the app can quiz you on.