What determines the strength of an authentication?

Question

Accepted Answer

The strength of the binding between the (partial) identity and the subject, which in turn depends on the number and the type of authentication means used.
Authentication can only be as strong as the link it relies on. A password can be shared, guessed, phished or written on a sticky note, so it ties an account to a person only loosely. A smartcard that only works with a PIN ties it much more tightly: an attacker would need both the physical card and the PIN.
Two levers raise the strength:

Number: every additional independent means forces an attacker to break one more thing. Two means of the same kind (two passwords) add little, because the same attack (phishing, a keylogger) captures both.
Type: means differ in how hard they are to steal or copy. A secret that is typed in can be observed and replayed; a private key that never leaves a chip and signs a fresh challenge cannot be replayed at all.

Assurance frameworks turn this idea into levels. NIST SP 800-63B, for example, requires one factor at AAL1, two distinct factors at AAL2, and at AAL3 two factors plus a phishing-resistant cryptographic authenticator with a non-exportable key. How such levels are defined and assessed is the subject of authentication quality and assurance levels.
Go deeper:

NIST SP 800-63B-4: Authentication Assurance Levels — how number and type of authenticators map to AAL1, AAL2 and AAL3.