What is Biometrics?
Authentication using unique physical or behavioral characteristics like fingerprints, facial features, iris patterns, or voice. While convenient, biometrics have a fundamental problem: you can't change them if compromised.
Also known as: Biometric Authentication, Biometric Security
Your fingerprint is not a password—it's a username. Biometrics are convenient identifiers, but they fundamentally differ from secrets you can change.
Types of Biometrics
Physiological
- Fingerprint: Most common, widely deployed
- Facial recognition: Face ID, airport security
- Iris/Retina: High security, less common
- Palm vein: Used in some banking
- DNA: Ultimate identifier, impractical for auth
Behavioral
- Voice: Call centers, banking
- Typing patterns: Continuous authentication
- Gait: How you walk
- Signature: Traditional but declining
The Fundamental Problem
Can't Be Changed
- Password leaked? Change it.
- Fingerprint leaked? You have 10. Forever.
- Once compromised, compromised for life.
Can't Be Secret
- You leave fingerprints everywhere
- Face is publicly visible
- Photos can capture iris patterns
- Voice is recorded constantly
Privacy Concerns
Centralized Databases
- Breaches expose permanent identifiers
- Government databases growing
- Private company collections
Surveillance
- Facial recognition everywhere
- Track individuals across locations
- No opt-out possible
Forced Authentication
- Can be compelled physically
- Unconscious/deceased unlock possible
- Different legal protections than passwords
Secure Biometric Use
On-Device Processing
- Template stored only on device
- Never sent to server
- Apple's Secure Enclave approach
As Second Factor Only
- Not replacement for password
- Convenience layer
- Fallback to password
Local Authentication
- Unlock local device
- Not for remote authentication
- Attacker needs physical access
Best Practices
- Use biometrics + password (not instead of)
- Prefer on-device processing
- Understand legal implications in your jurisdiction
- Have password fallback always enabled
- Consider disabling for border crossings
Related Terms
Passphrase
A sequence of words used as a password, typically longer and more memorable than traditional passwords. Passphrases like 'correct horse battery staple' provide strong security while being easier to remember than random character strings.
Two-Factor Authentication
A security method requiring two different types of identification to access an account: something you know (password) plus something you have (phone, hardware key) or something you are (biometric). This significantly reduces the risk of unauthorized access even if your password is compromised.
Have more questions?
Use our guided flow to get the right next privacy step for Biometrics.
Open Guided Flow