Working with Biometric Authentication
1. Understanding Biometric Factors
| Factor | FAR (typical) | FRR |
|---|---|---|
| Fingerprint | 1 in 50,000 | ~2% |
| Face (3D) | 1 in 1,000,000 | ~1% |
| Iris | 1 in 1,500,000 | ~0.1% |
| Voice | 1 in 10,000 | ~5% |
| Behavioral | Continuous, probabilistic | — |
2. Implementing Touch ID
Example: iOS LAContext
let ctx = LAContext()
var err: NSError?
if ctx.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &err) {
ctx.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics,
localizedReason: "Sign in to Acme") { success, error in
if success { /* unlock keychain item with biometric ACL */ }
}
}3. Implementing Face ID
| Requirement | Detail |
|---|---|
| Info.plist | NSFaceIDUsageDescription required |
| Fallback | Device passcode prompt |
| Policy | deviceOwnerAuthenticationWithBiometrics |
| Storage | Item with .biometryCurrentSet ACL — invalidates on enrollment change |
4. Using Windows Hello
| API | Use |
|---|---|
| Web Authentication | Platform authenticator via WebAuthn |
| UserConsentVerifier | WinRT API for native apps |
| WindowsHelloForBusiness | Enterprise, AAD-backed |
5. Implementing Android Biometric API
Example: BiometricPrompt
val prompt = BiometricPrompt(activity, executor,
object : BiometricPrompt.AuthenticationCallback() {
override fun onAuthenticationSucceeded(r: AuthenticationResult) {
val cipher = r.cryptoObject?.cipher
// Use cipher to decrypt key-bound secret
}
})
val info = BiometricPrompt.PromptInfo.Builder()
.setTitle("Sign in to Acme")
.setAllowedAuthenticators(BIOMETRIC_STRONG)
.build()
prompt.authenticate(info, BiometricPrompt.CryptoObject(cipher))6. Using WebAuthn for Biometrics
| Aspect | Detail |
|---|---|
| Authenticator type | platform (built-in) |
| User verification | required (forces biometric/PIN) |
| Key storage | Secure Enclave / StrongBox / TPM |
| Server check | flags.uv === true in authenticator data |
7. Handling Biometric Enrollment
| Step | Detail |
|---|---|
| Trigger | After initial password/MFA login |
| Check capability | OS API reports biometric available + enrolled |
| Generate key | Hardware-backed, biometric ACL |
| Send public key | Bind to server account |
| Confirm | Test signature → store enrollment |
8. Implementing Fallback Authentication
| Trigger | Fallback |
|---|---|
| Biometric failure (3x) | Device PIN |
| Biometric unavailable | Password + OTP |
| Enrollment changed | Re-enroll with password |
| Lockout | Account recovery flow |
9. Understanding Biometric Security Risks
| Risk | Mitigation |
|---|---|
| Spoofing (silicone fingerprint, photo) | Liveness detection |
| Template theft | Never store raw biometric — derived templates only |
| Coercion | Duress mode, panic codes |
| Irrevocable | Bind to cancelable device key, not raw biometric |
| Cross-context tracking | Per-RP unique credentials (WebAuthn) |
10. Implementing Liveness Detection
| Method | Detail |
|---|---|
| Active | User performs action (blink, smile, turn) |
| Passive | Texture/3D depth analysis (Face ID dot projector) |
| Challenge–response | Random head movement |
| Standard | ISO/IEC 30107 (PAD — Presentation Attack Detection) |
11. Storing Biometric Templates Securely
| Principle | Implementation |
|---|---|
| On-device only | Never transmit template to server |
| Secure hardware | Secure Enclave / TEE / StrongBox |
| Template protection | ISO/IEC 24745: cancelable, irreversible |
| Per-purpose | Separate templates per app (no cross-linking) |
12. Implementing Behavioral Biometrics
| Signal | Use |
|---|---|
| Keystroke dynamics | Typing rhythm, dwell, flight times |
| Mouse movement | Velocity, acceleration, curvature |
| Touch pressure | Pressure, area, swipe angle |
| Gait | Accelerometer / gyro pattern |
| Continuous auth | Score drift → re-challenge |