Biometric Authentication
Biometric authentication confirms a person by comparing a live measurement of a physical characteristic, such as a fingerprint or face, against a template captured at enrollment. NIST SP 800-63B-4 (section 3.2.3) says biometrics "SHALL only be used as part of multi-factor authentication with a physical authenticator", so a face or fingerprint is never a credential on its own.
The architecture matters more than the sensor. In a local match, the phone or laptop compares the biometric and uses it only to release a key held on the device; FIDO says that with passkeys "biometric information and processing continues to stay on the device and is never sent to any remote server" (FIDO Alliance). Server-side matching stores templates centrally, which NIST ranks below local verification and which turns a breach into a permanent loss, because a fingerprint cannot be reissued. Where biometrics are used, NIST requires a false match rate of 1 in 10,000 or better across demographic groups, presentation attack detection for facial recognition (recommended for fingerprint and iris, tested per ISO/IEC 30107-3), no voice matching, and a non-biometric alternative. A local biometric only gates the key: in August 2026 malware already running in a signed-in Windows session used a Windows Hello for Business key with no biometric prompt.
See also: biometric authentication as a regulatory frontier, top biometric authentication tools, passkey, FIDO2, BIPA, EU AI Act
Related on Start with Identity
- GlossarySynced Passkey
A synced passkey is a passkey that a passkey provider, such as a platform keychain or password manager, copies across the user's devices through a cloud service
- GlossaryPhishing-Resistant MFA
Multi-factor methods that cannot be relayed or replayed by a phishing site, principally FIDO2 security keys and passkeys. Recommended by NIST and CISA over OTP
- GlossaryWebAuthn
A W3C standard browser API for public-key authentication. WebAuthn is the protocol used by passkeys and FIDO2 security keys. The relying party server stores the
- GuidePasswordless Authentication Implementation Guide
A hands-on guide to implementing passwordless authentication using FIDO2, WebAuthn, and passkeys, including platform authenticator setup, migration strategies,
- CVEStrongKey FIDO Server credential-type confusion, passkey bypass
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High.
- CVEWindows stores WebAuthn assertions in cleartext event logs
The Windows Event Logging Service wrote WebAuthn assertions in the clear, readable by unprivileged or remote users. SpecterOps / Grafnetter chained it at Black