Passwords, OTP, MFA and Authentication

Learning objectives#

Recognize passwords, passphrases, PINs, one-time passwords, authentication factors and MFA; know why using two independent factors is stronger than a password alone; and distinguish ordinary OTP from phishing-resistant authentication.

Identity, authentication and authorization#

Identification is claiming an identity (for example, an account username). Authentication checks whether the claimant controls appropriate evidence, such as a password, authenticator or cryptographic key. Authorization determines which actions the authenticated user is permitted to perform. These steps are related but distinct. A person may successfully sign in yet not have permission to access a different customer’s record.

Passwords, passphrases and PINs#

A password is a secret memorized string used for authentication. A passphrase is typically a longer collection of words or characters and can be easier to remember while remaining strong if unpredictable and sufficiently long. A PIN is a numeric personal identification number used in specified systems or to unlock an authenticator; its security depends on surrounding controls such as retry limits.

Good habits include using a long, unique secret for each account, storing it in a reputable password manager when appropriate, avoiding commonly guessed patterns and not sharing it. A reused password exposes other accounts when one service is breached. Routine forced password changes are not inherently helpful in all systems; change an exposed secret promptly when compromise is suspected or required by policy.

Three classic authentication-factor categories#

Multi-factor authentication (MFA) uses authenticators representing more than one factor; this makes compromise of one factor less likely to be enough. Entering a password twice does not add another factor. A password plus an independent security key is a familiar example. Biometric unlocking of a device and a passkey can involve multiple factors, depending on the mechanism.

OTP and the limits of codes#

A one-time password (OTP) is a code intended for one use or a narrow validity period. Codes may arrive by SMS, email or authenticator app, and their role varies by system. A code alone is not necessarily MFA; two different codes do not necessarily represent independent factor categories. OTP delivery can be attacked through message interception, account takeover or real-time phishing pages.

Phishing-resistant authentication, such as appropriately implemented FIDO2/passkeys or hardware security keys, binds authentication to the legitimate service or a cryptographic challenge. These methods can resist some attacks that trick people into typing OTPs into fake pages. No authenticator removes the need for device and recovery security.

Simple sign-in examples#

1. Password only: One knowledge-based secret; account is vulnerable if password is stolen or guessed.
2. Password + app-generated code: Typically two-step sign-in using password plus possession of registered device; better protection than a password alone but may still be phished.
3. Password + physical security key: Adds possession-based cryptographic authentication; proper implementation can be phishing-resistant.
4. Two passwords: Usually the same factor type, so do not call it a textbook example of MFA solely because there are two fields.

Banking and payment distinction#

A bank may send an OTP during some account actions. A transaction-authorizing OTP and a UPI PIN should never be given to an unexpected caller or typed into an unverified page. They are not credentials that a bank employee needs to hear. If a payment prompt unexpectedly appears, cancel and verify through the trusted app or official bank channel.

Objective-exam facts#

Common confusions and exam traps#

• MFA ≠ any two credentials: Factors must be meaningfully independent.
• OTP ≠ impossible to steal: Real-time phishing can capture a valid code.
• Fingerprint ≠ infallible identification: Sensors, matching and recovery paths have limits.
• Authentication ≠ authorization: Signing in does not give all permissions.
• Long and unique ≠ permission to share: Passwords, PINs and codes remain confidential.

Quick revision#

1. Strong credentials are long, unique and appropriately stored.
2. Know/have/are are the classic factor types.
3. MFA uses more than one independent authentication factor.
4. OTP is temporary but not automatically phishing-resistant.
5. Passkeys/security keys can be phishing-resistant when properly deployed; never approve unexpected login or payment requests.

Practice questions — CA-09-04#

1. A username is entered, then a password confirms the claimant. The password step is:
A. Authorization
B. Authentication
C. Backup
D. Tokenization

2. After login, the system checks whether an employee may view one report. This is:
A. Authorization
B. Hashing
C. Smishing
D. Formatting

3. Which factor is traditionally a knowledge factor?
A. Fingerprint
B. Hardware key
C. Password
D. Smart card

4. A hardware security key illustrates:
A. Something you are
B. A backup
C. A hash digest
D. Something you have

5. A fingerprint is commonly classified as:
A. Something you are
B. Something you know
C. A network protocol
D. A one-time pad

6. Password plus the same password typed again provides:
A. Two independent factors
B. Not genuinely independent MFA
C. A fingerprint factor
D. A secure key pair

7. An OTP is best described as:
A. A certificate authority
B. A backup copy
C. A single-use or short-lived authentication code
D. A full-disk encryption key necessarily

8. Which statement about OTPs is accurate?
A. They cannot be stolen
B. They always resist phishing
C. They replace all passwords permanently
D. Real-time phishing can trick a person into giving a valid OTP

9. Properly implemented FIDO2 security keys or passkeys can provide:
A. Phishing-resistant authentication
B. A guaranteed fraud-free account
C. Automatically encrypted all bank statements
D. Unlimited password retries

10. A strong password strategy includes:
A. Same password on all sites
B. Long unique secrets and a manager when appropriate
C. Emailing passwords to oneself
D. Sharing login codes with support

11. What should a customer do when an unexpected transaction OTP arrives?
A. Read it to a caller
B. Forward it to the seller
C. Do not share it and verify activity through trusted channels
D. Post it on social media

12. Which claim is correct?
A. Authentication and authorization are synonyms
B. A biometric alone guarantees no account takeover
C. All two-step flows use different factors
D. MFA uses independent factor categories, not merely multiple fields

Answers and explanations — CA-09-04#

1. B — Authentication. Authentication verifies the claimed identity using an authenticator.

2. A — Authorization. Authorization determines permitted actions and data after identity checks.

3. C — Password. A password is a memorized secret and belongs to the knowledge-factor category.

4. D — Something you have. Possession of a physical cryptographic security key is a possession factor.

5. A — Something you are. Biometric matching is classified as an inherence factor.

6. B — Not genuinely independent MFA. Repeating one knowledge secret does not add possession or inherence evidence.

7. C — A single-use or short-lived authentication code. OTP stands for one-time password and is intended for one use or limited validity.

8. D — Real-time phishing can trick a person into giving a valid OTP. An attacker can relay a captured OTP before its validity expires.

9. A — Phishing-resistant authentication. Origin-bound cryptographic authentication resists many fake-site credential relay attacks.

10. B — Long unique secrets and a manager when appropriate. Uniqueness helps prevent credential reuse attacks and longer unpredictable secrets resist guessing.

11. C — Do not share it and verify activity through trusted channels. Unexpected codes may indicate a login or transaction attempt; never disclose them.

12. D — MFA uses independent factor categories, not merely multiple fields. MFA requires meaningfully different kinds of authentication evidence.