Retinal scanning falls under 'what we are' (biometrics) because it uses unique physical characteristics of the human body. The three authentication factor types are: what we know (passwords, PINs), what we have (tokens, smart cards), and what we are (biometrics like fingerprints, retina scans). 'What we use' is not a standard authentication category.