Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • 2
    I guess the main idea (but which you didn't explicitly mention) is one that Bruce Schneier already remarked: “Biometrics are unique identifiers, but they're not secrets.”. Crucial here is the distinction between identification and authentication. Identification is nothing more than to say “I am Foo”. Whether this happens via a name, a number or a fingerprint is irrelevant, but those are all just identification tools, not authentication. Commented Nov 4, 2011 at 9:55
  • @Joey, Biometrics can be secret too, well of course if you decide to use your finger or face it wouldn't be. Commented Jan 31, 2014 at 4:56
  • Having just (in 2016) stumbled across this answer, I'll note that while the idea that biometrics are only useful "in situations where passwords already provide adequate security" may or may not have been largely correct in 2011, some important developments have occurred since them. In particular, biometric authentication options have come into wide use that work with the secure modules in common devices to protect and use info that is used to authenticate the user to remote services. (For eg.: fingerprint recognition with the secure enclave on iPhone, Windows Hello with the TPM on a PC.) Commented Jul 8, 2016 at 23:18
  • Thus, you have an emerging model of the user doing biometric authentication to a local element that will then cryptographically attest of that user's identity to the remote service. This approach, of course, still has some flaws and limits. (Among them that the user can only use this way to access a service on devices where he or she has enrolled his or her biometric info into the device's secure element.) But it (perhaps) holds the potential to replace the hassle of using the now-ideal password + strong 2nd auth factor (eg. entering a code from a hardware token) combination in many scenarios Commented Jul 8, 2016 at 23:38