User authentication is the process of verifying an entity’s claim of holding a given identity. User authentication provides a level of assurance that the correct user is attempting to log in and access a system, application, or resource. An authenticator, such as a password or token, is the thing used to prove identity. An authentication solution can be based on a single authenticator (single-factor authentication) or multiple authenticators (multi-factor authentication). The combined strength of all authenticators used in a particular solution determines the level of authentication assurance, i.e. the certainty about correct identity of the user logging in. Paradoxically, a theoretically strong authentication solution can be bypassed if a user is tricked to send authenticators to the attackers, which can happen through social engineering and phishing attacks. Therefore, an authentication solution should be “phishing resistant” in order to give a high level of authentication assurance from a holistic perspective.