I've been thinking about this concept for a while now. In the technical world we authenticate ourselves to systems with explicit credentials. In the social world, authentication takes place with much less explicit means, often without any identification. Understanding this concept of 'soft authentication' is integral to social engineering attacks, but also to interacting with other people.

The examples for social engineering attacks are fairly straightforward. If you dial into a company's main receptionist in an attempt to elicit some information (say, a password or account name), you're much more likely to get the data if you use the right vocabulary. You need to know what their IT department is called (IT, tech services, IS, etc). You need to know, maybe, what they call their main corporate office (HQ, corporate, home office, a city name, etc). These kinds of subtle clues tell the person you're talking to that you're 'part of the system,' i.e. they authenticate you. If you use the wrong words, the person on the other end will immediately know something is wrong, though they may not be able to describe exactly what it is.

This is soft authentication, used to access a social system. In fact, the soft authentication may not even be verbal. Wearing the right uniform, for example, would be a physical example. Carrying the right type of bag, or equipment is another example.

The model applies, however, outside of social engineering as well. In fact, it's part of human culture. I'm thinking of this because I just sent an email to a customer service address for an order I'm waiting for. I re-read what I had written and realized that it didn't sound like me at all. In fact, it sounded like the marketing text on their website. I had, without thinking about it, adapted my speech to meet the cultural niche that they advertise themselves as being a part of. In other words, I attempted to authenticate myself to them in order to get better service.

Of course, this type of soft authentication is just part of interacting with other people. We are constantly assessing others based on both verbal and non-verbal clues to determine how to relate to them, what information to share, and what categories they fit into. Most of the time, this is not a conscious process, but the people who can pull it into their conscious minds can more successfully determine what the relevant authentication techniques are. They can then be more aware of when and how they are authenticating people, and ultimately more careful about what information they give out.