BSD authentication Originally appeared in BSD/OS Used throughout the system Including OpenSSH Authentication methods run as separate programs Communicate to parent via a socketpair Encapsulation of privilege main programs often need not be setuid Small programs are easier to verify