Biometric Authentication: Convenience, Risk and Getting It Right

You can change a password. You cannot change your face. That single fact shapes everything about biometric authentication: it's the most convenient credential ever built, and the one whose compromise is permanent. Billions of people now unlock phones with a fingerprint or a glance, so getting the design right — what's stored, where it's matched, and what happens when it fails — matters more than ever.

How biometric matching works

A biometric system never stores your fingerprint. During enrolment, a sensor captures the trait and software extracts a compact mathematical representation — a template: minutiae points and ridge angles for a fingerprint, a vector of facial geometry for a face, spectral features for a voice. At authentication, a fresh capture is converted the same way and compared to the template; a similarity score above a threshold means "match".

Because captures are never identical, the threshold sets a trade-off between two error rates: the false acceptance rate (an impostor gets in) and the false rejection rate (the real user is locked out). Tighten one and the other rises. Consumer devices typically tune for a false acceptance rate around one in 50,000 (fingerprint) to one in a million (3D face), with fallback to a PIN so false rejections are an inconvenience rather than a lockout.

The modalities and their trade-offs

• Fingerprint: mature, cheap, accurate. Capacitive and optical sensors are ubiquitous; ultrasonic ones work through screens. Vulnerable to lifted prints without liveness checks; struggles with worn or wet fingers.
• Face: the most convenient. 2D face recognition (a photo) is easily spoofed by another photo; 3D systems using structured light or time-of-flight depth (Apple's Face ID, Windows Hello with IR cameras) are far more robust. Performance varies with lighting, ageing and — historically — demographic group.
• Iris: extremely accurate and stable over a lifetime; needs near-infrared imaging at close range, which limits it to border control, high-security access and some phones.
• Voice: convenient for phone channels; now seriously threatened by AI voice cloning, to the point that voice alone should no longer be treated as a strong factor.
• Behavioural: typing rhythm, gait, how you hold and swipe a phone. Not strong enough to authenticate alone, but useful for continuous, passive risk scoring behind the scenes.

Spoofing and liveness

Presentation attacks — a printed photo, a silicone finger, a replayed voice recording, a deepfake video on a screen — are the core threat. The defence is liveness detection: checking that the trait is attached to a living person present at the sensor. Techniques include depth sensing, detecting blood flow or skin texture, requiring a randomised action (turn your head), and analysing the micro-movements that a replayed video lacks. Standards (ISO/IEC 30107) define how to test it. As generative AI makes convincing fakes trivial, liveness has gone from optional to essential, especially for remote identity verification where the "sensor" is a user's own webcam.

The template is the crown jewel

A leaked password database is bad; a leaked biometric database is worse, because the users can't rotate their faces. The 2015 breach of the US Office of Personnel Management exposed 5.6 million fingerprint records permanently. The design principles that follow:

• Match on device, not in the cloud. Phones store templates in a hardware-isolated secure enclave and never export them; the operating system only ever learns "matched" or "didn't". This is the model to copy.
• Protect templates cryptographically where central storage is unavoidable — cancellable biometrics (a transformed template that can be revoked and re-issued), encryption with keys held elsewhere, or homomorphic matching.
• Minimise. Collect only what's needed, keep it only as long as needed, and don't build a central biometric database if the use case doesn't strictly require one.

Biometrics and passkeys

The most important shift in the past few years is that biometrics have become the local unlock for a stronger cryptographic credential rather than the credential itself. With passkeys (FIDO2/WebAuthn), your device holds a private key; your fingerprint or face authorises the device to sign a challenge from the website. The site never sees biometric data, there's nothing to phish, and the biometric never leaves the enclave. This is why biometric login can be both extremely convenient and phishing-resistant — see Multi-Factor Authentication for the wider picture.

Privacy, bias and law

Biometric data is classed as sensitive under GDPR, requiring explicit consent or another narrow legal basis; Illinois's BIPA has produced substantial settlements against companies that collected face data without consent; and the EU AI Act restricts real-time remote biometric identification in public spaces. Accuracy disparities across skin tone, sex and age — documented in NIST's ongoing vendor testing — have narrowed considerably in recent algorithms but haven't vanished, and must be measured for any deployment that affects access to services. Authentication (is this the person who enrolled?) and identification (who, out of millions, is this?) are different problems with very different risk profiles; the second is where most of the legal and ethical hazard lives.