Differentiating Authentication from Authorization

What is this page about?

An explanation of the difference between authentication (proving who you are) and authorization (controlling what an authenticated user can access), illustrated with the 2022 Uber breach where an attacker authenticated via social-engineered MFA then exploited weak authorization to reach privileged systems. It covers authentication mechanisms and multi-factor layering, authentication protocols, authorization models and least privilege, the handoff organizations botch, privilege-escalation attacks, Zero Trust architecture, adaptive risk-based controls, and how to implement both correctly.

What has been corrected on this page?

Every accepted correction to this page is recorded with the exact change, so readers can see how the page improved over time.

1. 11 July 2026 · corrected by Melik Can Sariyer

   Wrong institution: 'The Tangled Web of Password Reuse' (Das et al., NDSS 2014) authors were at University of Illinois and Indiana University, not Carnegie Mellon.

   Before

   Researchers at Carnegie Mellon University analyzed 6.5 million passwords from actual breach datasets

   After

   Researchers at the University of Illinois at Urbana-Champaign and Indiana University analyzed 6.5 million passwords from actual breach datasets

   Why: The Tangled Web of Password Reuse (Das et al., NDSS 2014) was authored by researchers at University of Illinois and Indiana University, not Carnegie Mellon.

   View the full record →

Who checked this page?

1 contributor has checked "Differentiating Authentication from Authorization" on When Notes Fly. Each name below links to that person's public CitePep profile, where every contribution they have made is listed with the exact change they proposed.