A typical login collects a username and password, but credentials may instead include a certificate, passkey, security key, one-time password, or another authenticator. Some components identify the account; others prove control of it.
The components need different handling. A username is often not secret; a password is a shared secret; and a passkey proves possession of a private key without sending that key to the service. Successful login normally creates an authenticated session with its own secret, which must remain protected even though it was not entered on the login screen.
Key points
Authentication designSelect authenticators according to the required assurance, phishing resistance, user population, device context, and recovery risk.
Storage and transportProtect authentication exchanges, store password verifiers rather than recoverable passwords, and keep private keys and other secrets out of logs and untrusted applications.
LifecycleSecure enrollment, binding, reset, recovery, replacement, revocation, and compromise response; weak fallback can undermine the normal login method.
Important limitation“Credentials accepted” does not prove the legitimate owner is present. Stolen passwords, authenticators, recovery channels, or session secrets can let an attacker appear to be a valid user.