The Password You Can’t Forget and Can’t Change
Biometric authentication — verifying identity through fingerprints, facial structure, iris patterns, or other physiological characteristics — has become the primary authentication method on smartphones and is expanding into laptop login, payment systems, border control, and workplace access. The appeal is obvious: biometrics can’t be forgotten, are always present, and are more difficult to steal than passwords. The risks are equally specific and often understated: biometrics can’t be changed if compromised, they reveal information about your physical identity, and their security properties differ in important ways from password-based systems.
Understanding biometric security requires distinguishing between different use cases, different implementation quality levels, and the specific threat scenarios that biometrics address well versus those they don’t address at all.
How Biometric Systems Actually Work
Fingerprint and face recognition systems don’t store your actual fingerprint or photograph. They create a mathematical representation (a template) of the biometric data during enrollment, store this template (usually encrypted, often in a secure hardware enclave), and compare new biometric samples against the stored template during authentication. The actual biometric isn’t retained in recoverable form — the template is a one-way transformation.
The quality of the comparison algorithm determines two security parameters: False Accept Rate (FAR — how often the system authenticates the wrong person) and False Reject Rate (FRR — how often it fails to authenticate the correct person). Apple’s Face ID specification claims a 1-in-1,000,000 FAR (it will authenticate the wrong person with one-in-a-million probability). The actual security properties depend on both the algorithm and the hardware sensor quality — cheap fingerprint sensors on budget devices have significantly worse security characteristics than Apple’s or Samsung’s implementations.
Biometrics vs. Passwords: What Each Protects Against
Biometrics are stronger than passwords against remote attacks: your fingerprint can’t be phished, can’t be stolen from a database breach (because the template isn’t stored in a form that can be converted back to a biometric), and can’t be guessed from data breaches of other accounts. These are significant advantages that explain why biometric authentication has largely replaced PINs for everyday smartphone access.
Biometrics are weaker than passwords against physical coercion: in many jurisdictions, a person can be compelled to provide a fingerprint or face for authentication purposes in ways that they cannot be compelled to reveal a memorized password. A person who’s unconscious or restrained can be biometrically authenticated without their cooperation. And a high-quality photograph or 3D model of a face may defeat some facial recognition systems — the 2019 demonstration that simple infrared-reflective glasses could fool some facial recognition systems highlights that attacker creativity can find unexpected bypass methods.
The Legal Dimension: What Authorities Can Access
The legal distinction between compelled biometric authentication and compelled password disclosure has been tested in multiple US court cases with inconsistent outcomes across jurisdictions. The general principle that has emerged: compelling someone to provide a fingerprint or face scan may be treated more like compelling a physical act (opening a locked box) than compelling testimony (which the Fifth Amendment protects against), while compelling disclosure of a memorized password may receive Fifth Amendment protection as testimonial.
Practically: if you’re in a situation where you’re concerned about government access to your device, switching your authentication to a strong PIN or passcode rather than fingerprint or face provides stronger legal protection in some jurisdictions. For everyday use where law enforcement access to your device isn’t a concern, biometrics’ convenience advantages clearly outweigh this consideration — but the legal landscape is worth understanding for contexts where it might matter.
Biometrics and Privacy: The Data That Can’t Be Revoked
When a password is compromised, you change the password. When a fingerprint template is compromised from a system that stores it insecurely, you cannot change your fingerprints. The 2015 US Office of Personnel Management data breach included 5.6 million fingerprint records of government employees and clearance holders — biometric data that can’t be rotated or reset, creating a permanent compromise of those individuals’ fingerprint authentication wherever it’s used.
The appropriate scope of biometric data sharing reflects this permanence: biometrics stored locally on your device (Apple’s Secure Enclave, Android’s Trusted Execution Environment) are more appropriate for sensitive applications than biometrics stored in a vendor’s cloud database. Before enrolling biometrics in any system, consider whether the storage is local or remote, how the stored template is protected, and whether the vendor has a history of security breaches. The irreversibility of biometric compromise makes the storage and security model more consequential than equivalent decisions for password-based systems.
