Are biometric logins as secure as they are convenient?

Biometric logins are convenient. They replace the standard username and password logins. Instead of typing in credentials, a user can simply use his fingerprint to authorize access to certain content.

But are biometric logins as secure as they are convenient? How ready are we to link our identity with online accounts?

Why are biometric logins so attractive to users?

Biometric logins are very user-friendly: it is a fast, convenient, and reliable authentication method.

In a facial recognition system, device algorithms pick out distinctive facial details. First, the system captures the image of the face. Then it translates the image to numerical data to analyze the distance between the eyes, ears, eyebrows, lip shape, chin, and other parts of the human face. This retrieved data is then compared to what is stored in a database.

A few of the most popular types of biometric logins are:

• fingerprint scanning,
• retina scanning,
• iris recognition,
• face recognition,
• voice recognition,
• and others.

Such an authentication method is attractive to regular users. People will always have the same face, retina, or fingertips. (And they will change slowly, with age.)

Therefore, there is no need to remember your credentials when you have your fingertips. You always carry them with you.

How secure are biometric logins ? Security and privacy debate.

Security risks associated with biometrics.

One of the highest risks associated with biometrics is the irreplaceability factor. A human has only 10 fingertips and a single, unique face for his whole life. If your biometric data is leaked, contrary to passwords, you have no (or very limited) possibilities to update it. Hence, you need to trust the service provider for secure biometric data storage.

A cyber attack happens every 39 seconds. The chances that the provider with your data becomes a target are high. Use biometrics as the login option only if you trust the service or a platform.

Last, although biometric logins have a low false acceptance rate, they still have it. iPhone smartphones might not distinguish the difference between two siblings or identical twins.

This reveals a potential security vulnerability. Recognition systems can be tricked by family members by using masks, photos, and copies. This also increases the risk of unauthorized unlocking of the device while the owner is asleep. In such cases, passwords are a more secure choice.

Privacy risks associated with biometrics.

Biometric logins also pose privacy risks. Biometrics authorize a person through his personal attribute (which becomes a part of his online identity).

In regular password-based authentication, the password does not reveal any information about the user. In biometrics, a human part becomes a verification factor.

Therefore, exposure to biometric data can lead to identity attacks and other privacy issues.

For instance, if a hacker receives a person’s biometric data, he can use it to access banking, legal, and other sensitive personal information. In this case, the hacker owns more than a quickly replaceable password – he now possesses a part of a human’s online identity.

Also, the service provider might use biometrics to track users’ activities that which they did not give consent. For example, the workplace might use face recognition to grant access to the building and secretly record employees’ work and break schedules.

Linking one’s identity to accounts is convenient but raises critical security and privacy concerns.

PassCamp’s approach to biometrics

PassCamp is a reliable, secure, and super intuitive password manager that offers biometric login in its mobile app.

When we started developing the PassCamp mobile app, the community asked for a biometric login option for convenience reasons. Having weighed the potential risks, we knew we had to find the safest possible solution to satisfy our users’ needs.

Here’s how biometric logins are now securely implemented in PassCamp.

First, we always leave users a choice to use biometrics or not. If they do not want it, they can sign in to their account by typing their Master Password.

Then, we strongly suggest turning on Two-factor authentication (2FA) so that nobody can access the account without proving their identity first. 2FA serves as the second layer of security and minimizes the risk of unauthorized login.

Last, PassCamp uses the most secure, currently existing method to store users’ data. Military-grade encryption prevents data from leaks and breaches. The zero-knowledge protoco l ensures that even PassCamp developers cannot access or reveal any stored data. Even if the user loses his device, nobody can access his sensitive data.

When it comes to biometric logins, data safety should be the priority. After we found a way to ensure the security of biometric data, we decided to add this handy feature to our mobile app. But even now, we allow users to decide by themselves – whether to use biometric logins or not.