Terminology: authentication vs verification

Let's pretend we ordered some movie tickets online, and the process of later acquiring them involves identification in person at the box office before the event. You will be asked to produce your identification document (ID). That's identification. The box office attendee will then verify your identity by visually inspecting your ID - that's identification verification. This attendee will then check against their database to verify you've purchased those tickets online, and give them to you - that's verification and you end up with an authentication token (in our case - a ticket). You will then produce those tickets before entering the theatre - that's authentication.

So in short, identification is a sub-process (integral part) of identity verification, which is a sub-process (integral part) of verification, which is a sub-process (integral part) of authorisation.

In each of these steps, you verify one set of data of the client, against another set of data of the service provider. In multi-factor authentication, this data can have different forms and/or roles, such as something the user is, something the user has, something the user knows, e.t.c., or the previous sub-process produces new set of data (or a ticket, token, nonce,...) that the next process uses to determine the outcome of its function. The level of verification, or number of times the producer's data is verified against, (or scrutiny, as @TerryChia put it), denotes how we in turn call this verification process.

TL;DR - If it involves verifying access permission, we call this verification process as authentication.


I think that the difference between the two is simply the level of scrutiny.

To verify a persons identity, requiring him to present some sort of identification like a passport or drivers license is probably enough. The word verify itself seems to suggest to me the process of tying a user account to some sort of real world identity.

To authenticate a person, identification methods through passports or drivers license might not be good enough. Those items are handled by many different people and can be forged or faked. The process of authentication might requiring the person to provide some sort of secret that should only be known to that person. Passwords are a common form of such a secret.

I have no idea about it's reliability, but this site seems to back my idea of the difference between the two.


Verify and Authentication similar but aren't the same.

In the online environment, verification simply means to "verify" the INFORMATION provided is accurate. Meaning, yes, this is a person's DOB, or Address, or password, etc. It does NOT verify the actual person, JUST the information. So, if I enter my driver's license information for "verification" you can verify that the information I provided is correct, but you can't say whether or not that I am the actual owner of the driver's license.

Authentication, on the other hand, verifies the individual. The actual person. You need at least two "verification" to authenticate. You must have two of the following: Something you know (DL information, pin/password, code word, etc.); something you have (in their possession - cell phone, smart card, HANDING you a DL, etc.); or something you are (biometrics - finger print, visual identification, etc. DL in person...)