How do threats to authenticators differ by factor type?

Something you know can be disclosed or guessed; something you have can be lost, stolen, damaged or cloned; something you are can be replicated or falsely matched.

* Each factor fails differently, which is why combining two of them helps. *

• Knowledge: an attacker guesses the password, observes it being typed, tricks the user into revealing it, or steals the verifier's hash database and runs a dictionary attack on it.
• Possession: a hardware token is stolen or tampered with, a software authenticator is copied from the owner's computer, an out-of-band code is intercepted.
• Inherence: someone obtains a copy of the fingerprint and builds a replica, or the matcher accepts a similar-enough sample (false match).

Because these threat families hardly overlap, a combination such as card + PIN requires two unrelated successes (steal the card and observe the PIN). One threat is outside every technical defence: a subscriber who deliberately colludes with an attacker and hands over their authenticators.

Go deeper:

• NIST SP 800-63B-4: Authenticator threats — the factor-based categorisation and the full threat table.