Biometrics

Biometrics is the use of unique physical or behavioural characteristics to authenticate somebody and verify their identity.

Those characteristics can include facial features, fingerprints, the iris, or patterns in a voice.

It has become a standard part of authentication in a wide range of settings, from mobile devices and physical access systems to online applications and payments, and its main appeal is that it reduces dependence on passwords, which fail in well-known ways.

What characterises it

Physical and behavioural. Physical biometrics uses fingerprints, faces, irises and voices. Behavioural biometrics uses how somebody signs, types or moves, which is a weaker signal on its own and a useful one in combination.

It belongs inside multi-factor. Biometrics is normally combined with another factor rather than used alone, which is what makes multi-factor authentication stronger than any single method.

The algorithm decides the security. How well biometrics works depends on the recognition algorithm that compares the sample with the stored template, and specifically on whether it resists deliberate attempts to fool it.

Privacy is not a side issue. Biometric data has to be stored and processed securely and in line with data protection law. In the EU it is a special category of personal data, which raises the bar on the legal basis required as well as on the technical protection.

A worked example

A company deploys facial recognition to control access to its premises.

Employees enrol, and the system stores a template derived from their facial features rather than a photograph.

When somebody arrives, the system compares what the camera sees with the enrolled templates, and grants access on a match.

Alongside that, the deployment has to answer two questions that are not about the camera: where the templates are stored and who can reach them, and whether the system resists presentation attacks, meaning attempts to fool it with a photograph, a mask or a three-dimensional model.

The property that makes it different

Every other credential can be changed. A password can be reset, a certificate reissued, a token revoked. A fingerprint cannot.

That single fact has three practical consequences, and they are the reason biometrics is designed the way it is on well-built systems.

The first is that the template should never leave the device. Modern implementations store it in a secure element on the phone or laptop and answer only yes or no, so there is no central database of biometric templates to steal. A deployment that ships raw biometric data to a server has created an asset that cannot be rotated after a breach.

The second is that biometrics authenticates a person to a device, and the device authenticates to the service. That is exactly how a passkey works, and it is why the fingerprint is best understood as the thing that unlocks the credential rather than as the credential itself.

The third is that the threat model has moved. Synthetic voice and video, which the glossary covers under deepfake, have made remote biometric verification a weaker check than it was, which is why liveness detection is now a requirement rather than a refinement.

Where to read more

Biometrics Institute: independent material on developments in biometrics, including guidance on responsible deployment.

IEEE, An introduction to biometrics: an overview of the concepts, the challenges and the applications.