What is authentication?¶
Authentication is the process a service uses to decide whether the credential, device or security process presented to it should be accepted. It confirms that the required check succeeded; it does not, by itself, identify the human being who obtained access.
What may be authenticated¶
The simplest example is a username and password, but authentication can involve several different mechanisms. A service may accept:
- a password or PIN;
- a one-time code;
- an authenticator-app approval;
- a physical security key;
- a fingerprint or facial-recognition result;
- a trusted device;
- an existing session token; or
- an account-recovery process.
The record therefore needs to be read in context. A message stating that authentication was successful may refer to a newly entered password, an already trusted device or an existing authenticated session.
What the record may show¶
Authentication records can help establish how access was granted. Depending on what the provider records, they may identify:
- the authentication method;
- the time of the event;
- the account or service involved;
- a device, browser or application;
- an IP address or connection;
- whether an additional factor was required; and
- whether a recovery or security-setting change preceded access.
Those details can support a wider account-access timeline and may strengthen links between an account, a device and a particular event.
What successful authentication does not establish¶
The service normally checks the credential or process, not the person. A valid password may have been shared, saved, stolen or obtained through malware. A trusted device may be used by more than one person. A session token may permit access without the user entering a password again.
Even biometric authentication should be described carefully. The record may show that a device accepted a biometric check, but its evidential significance depends on how that device and application work and who controlled the device at the relevant time.
What to establish next¶
Ask:
- what exactly was authenticated;
- which method was used;
- whether the session was new or already established;
- which device or factor completed the process;
- whether security settings had recently changed; and
- what other evidence links the event to a person.
Use precise wording. “The account was successfully authenticated” is a technical conclusion. “The registered account holder personally logged in” is a separate attribution conclusion requiring further evidence.
Key takeaway
Authentication shows that a service accepted the credential or process presented to it. Identify the method, device and surrounding evidence before attributing the access to a person.