Company X uses multi-factor authentication (MFA) to decrease the likelihood of a successful cyber-attacks by requiring one or more additional verification factors: something you know, something you have, or something you are.

  • Something you know --> e.g. password
  • Something you have --> e.g. YubiKey, Duo
  • Something you are --> ?
  • 15
    How did you try to find the answer yourself before asking here? When I type "something you are" into Google, the very first (featured) result says "something you are is an information that is in you — it's a characteristic that only you and no one else has it. That includes, but is not limited to, your fingerprint or thumbprint, palm, handprint, retina, iris, voice and face". Some other results from that Google search may go into more details, if necessary.
    – NotThatGuy
    Jan 26, 2022 at 13:18
  • 1
    It should be understood as "who you are", but it's stated that way to mirror the other factors.
    – Barmar
    Jan 26, 2022 at 15:18
  • 4
    "I thought googling such as broad sentence ('something you are') would never result in its definition in computer security subject" - I wasn't particularly hopeful about that either, but it was the simplest thing to try. If that didn't work, I would've tried adding "(computer) security" or "(multi-factor) authentication" to the search query, or adding both "something you know" and "something you have" (I expect that many sites will discuss all 3 together), or phrasing it more as an actual question ("what does something you are mean").
    – NotThatGuy
    Jan 26, 2022 at 15:43
  • 1
    @Barmar all authentication boils down to proving who you are; these three methods describe how you prove it. Jan 26, 2022 at 18:10
  • 2
    @Barmar "Something you are" can be transferred. I'm reminded of that scene in Demolition Man... Jan 26, 2022 at 21:58

1 Answer 1


Something you are refers to biometric identification. Examples of this could include:

  • fingerprint
  • voice print
  • facial recognition
  • vein pattern and blood flow detection
  • behavioral biometrics, such as gait or typing timing

This is described in NIST SP 800-63B section 5.2.3 which does not list specific methods, but describes requirements and how to use them.

Section 10.4 lists usability considerations of these specific biometrics, including problems with their reliability:

  • Fingerprints
  • Face
  • Iris
  • 10
    All it takes is good scissors for finger to become something you have.
    – lolesque
    Jan 26, 2022 at 14:24
  • 2
    ...or something you "don't have", in the case of a running motorbike chain, if you're careless and have a sudden attack of the stupids (completely hypothetical)
    – bertieb
    Jan 26, 2022 at 16:43
  • 4
    There's also a slight ableist issue with biometrics because they all assume that you're physically capable of reaching the fingerprint / iris scanner (wheelchair users or people with dwarfism are screwed), voice print (asthmatics; good luck speaking a full sentence for a week or so after a solid asthma attack - speaking from experience), etc. Jan 26, 2022 at 18:09
  • 7
    @TylerH I heard a story a little while ago about someone that worked in a secure US military facility. He injured his hand over the weekend. After arriving on base he went to work and within 15 minutes he had military police in his office asking him to identify himself. Their security software had picked up on the change to his typing cadence and flagged him as a possible imposter. Jan 26, 2022 at 18:41
  • 6
    @TylerH It's stupid for more reasons than that. Biometric data can't be changed like a password, and (unless there have been recent breakthroughs) can't be hashed like a password. Both of these factors increase the severity of the inevitable data breaches. Jan 26, 2022 at 21:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .