14

The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a passport of driver's license. You also check for signs that the document is not a forgery. If it all checks out, you'd let them into a bar, let them open a bank account or something like that.

Authentication is very similar. You ask for knowledge, possession and/or inherence factors to check if someone for example is allowed to log in to his e-mail or internet banking. Is there a difference between the two, and if so, what's an easy to understand explanation for it?

Edit to clarify what's confusing for me: isn't the verification of a person's identity in my example a form of authentication with a possession factor?

  • 3
    Authentication is the process via which you verify whether someone's identity is genuine or not; so you verify to authenticate. – Lex May 31 '13 at 9:14
  • There is a very interesting technology that blurs the lines between authentication and verification. See Microsoft U-Prove – Christopher Aug 6 '13 at 21:25
14

Let's pretend we ordered some movie tickets online, and the process of later acquiring them involves identification in person at the box office before the event. You will be asked to produce your identification document (ID). That's identification. The box office attendee will then verify your identity by visually inspecting your ID - that's identification verification. This attendee will then check against their database to verify you've purchased those tickets online, and give them to you - that's verification and you end up with an authentication token (in our case - a ticket). You will then produce those tickets before entering the theatre - that's authentication.

So in short, identification is a sub-process (integral part) of identity verification, which is a sub-process (integral part) of verification, which is a sub-process (integral part) of authorisation.

In each of these steps, you verify one set of data of the client, against another set of data of the service provider. In multi-factor authentication, this data can have different forms and/or roles, such as something the user is, something the user has, something the user knows, e.t.c., or the previous sub-process produces new set of data (or a ticket, token, nonce,...) that the next process uses to determine the outcome of its function. The level of verification, or number of times the producer's data is verified against, (or scrutiny, as @TerryChia put it), denotes how we in turn call this verification process.

TL;DR - If it involves verifying access permission, we call this verification process as authentication.

  • 1
    Thanks! The comment by @Lex set me thinking along the same path. Successful verification that one or multiple forms of proof (ID, password, code received by SMS) are correct lead to successful authentication, giving you access to something. – Rafe May 31 '13 at 10:46
  • Because I cannot edit my previous comment: of course you're only granted access if you're also authorized for that same something. But authentication vs authorization is already well explained on the internet :) – Rafe May 31 '13 at 11:00
  • 1
    @Rafe - Sure, and if you need to add authorization to the mix in the example I used, then you could say the ticket-clipping upon entering the theatre can be called that. So in a sense, the authenticator has authorized your access (you're left with a ticket clipping, so if that authorisation is ever disputed, it can be repeated and/or traced back to previous verification points). – TildalWave May 31 '13 at 11:07
  • "If it involves verifying access permission, we call this verification process as authentication" - the kind of statement that confuses! Authorization can also be the verification of access permission, just that in this case, we are verifying if someone/something has permission to access some kind of resource/object. Conversely, Authentication involves verifying if someone/something has permission to access a particular system (i.e. asking the question 'are you who you claim to be'?). So, they are both 'verifying access permission', just in different contexts! – Damilola Olowookere Aug 16 '17 at 14:28
5

I think that the difference between the two is simply the level of scrutiny.

To verify a persons identity, requiring him to present some sort of identification like a passport or drivers license is probably enough. The word verify itself seems to suggest to me the process of tying a user account to some sort of real world identity.

To authenticate a person, identification methods through passports or drivers license might not be good enough. Those items are handled by many different people and can be forged or faked. The process of authentication might requiring the person to provide some sort of secret that should only be known to that person. Passwords are a common form of such a secret.

I have no idea about it's reliability, but this site seems to back my idea of the difference between the two.

3

Verify and Authentication similar but aren't the same.

In the online environment, verification simply means to "verify" the INFORMATION provided is accurate. Meaning, yes, this is a person's DOB, or Address, or password, etc. It does NOT verify the actual person, JUST the information. So, if I enter my driver's license information for "verification" you can verify that the information I provided is correct, but you can't say whether or not that I am the actual owner of the driver's license.

Authentication, on the other hand, verifies the individual. The actual person. You need at least two "verification" to authenticate. You must have two of the following: Something you know (DL information, pin/password, code word, etc.); something you have (in their possession - cell phone, smart card, HANDING you a DL, etc.); or something you are (biometrics - finger print, visual identification, etc. DL in person...)

0

I assume by "verification" you mean "identity verification." I agree with your interpretation of that word as a linking activity between the real world and the online world:

Identity verification is a real-world trust-building activity performed when a person is first added to a database. Depending on the needs of the database, this might involve asking neighbors, associates, and the police, and/or taking biometric information. A similar process is undertaken by a bank when you first open an account with them. Once verified, the person needs to be assigned a unique identifier, asserting that they are a distinct person from anyone seen by the database before. Along with this identifier, they usually arrange some secrets like passwords or PINs for future authentication.

"Authentication" is an online activity performed when the database is approached by a user or by an agent on their behalf, claiming that they are someone by presenting their identifier. Authentication involves verifying the identifier by using the pre-arranged secrets.

The above interpretation is used in a paper by Shweta Agrawal, et. al, where they critique the privacy and security guarantees made by India's national identification system called Aadhar: http://www.cse.iitd.ernet.in/~suban/reports/aadhaar.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.