Section · 8 pages
Authentication
Proving who someone is, and how much that proof is worth. Written from NIST SP 800-63B-4, CISA guidance and the W3C WebAuthn specification.
Authentication MFA strength compared
All MFA beats passwords alone, but not equally. A side-by-side of what each form resists, using CISA's ranking and NIST SP 800-63B-4's requirements.
Authentication Phishing-resistant MFA
Authentication whose output only works for the genuine site, without relying on the user to spot the fake. How it works, what qualifies, and what it does not cover.
Authentication Passkeys
FIDO credentials that replace passwords and resist phishing. What synced and device-bound passkeys are, which assurance level each can reach, and what changes for recovery.
Authentication WebAuthn
The browser API behind security keys and passkeys. The two ceremonies step by step, the data your server receives, and the checks it must make.
Authentication NIST password rules
SP 800-63B-4 turned several 2017 recommendations into requirements. Each rule with its exact strength word and section, how to store passwords, and what changed.
Authentication Assurance levels: IAL, AAL, FAL
Three separate dials for proofing, authentication and federation. What each level requires in the 2025 revision, and which levels fit privileged users.
Authentication OTP and push authentication
The most common second factors, how they work under the hood, why push bombing works, what number matching fixes, and why both remain phishable.
Authentication Account recovery
Recovery is often the easiest way into an account. The four methods NIST recognizes, what each assurance level requires, and how to resist help-desk social engineering.