## Authentication (AuthN)

"Who are you?"

### The Three Factors
1.  **Type 1: Something you Know**: Password, PIN, Mother's Maiden Name.
    *   *Weakness*: Can be guessed or phished.
2.  **Type 2: Something you Have**: Smart Card, Phone (SMS Code), YubiKey.
    *   *Weakness*: Can be stolen or lost.
3.  **Type 3: Something you Are**: Biometrics (Fingerprint, Retina, FaceID).
    *   *Weakness*: Privacy concerns. You can't reset your face if it is compromised.

### MFA (Multi-Factor Authentication)
Combining two *different* factors.
*   Password + PIN = **NOT MFA** (Both are Type 1).
*   Password + SMS Code = **MFA** (Type 1 + Type 2).
*   **Impact**: MFA stops 99.9% of automated account takeovers.