Biometric Authentication: Methods, Security and Data Protection

What Is Biometric Authentication?

In authentication, a person proves that they are who they claim to be. There are three types of proof: something you know (a password), something you have (a smartphone or security key) and something you are. Biometrics is the third factor.

The word comes from Greek: "bios" means life, "metron" means measure. Biometrics therefore measures traits of a living person.

We come across it all the time: when unlocking a smartphone by fingerprint, with face recognition on a laptop or at automated passport control at the airport.

Biometric Methods at a Glance

Physical Traits

• Fingerprint: the best-known method. Cheap, fast and widely used.
• Face recognition: on smartphones often with 3D sensors that measure depth and so spot photos.
• Iris recognition: very accurate, but more costly. Often used in high-security areas.
• Vein recognition: measures the vein pattern in the hand or finger with infrared light. Hard to fake.
• Hand geometry: measures the shape and size of the hand. Mostly used for physical access control.

Behavioral Traits

• Voice: for example on phone hotlines. Open to AI voice clones.
• Typing behavior: rhythm and pressure when typing.
• Signature: not just the image, but also speed and pressure while writing.
• Gait and movement: for example how someone holds a smartphone.

Behavioral traits are often used in the background to check that the same person is still at the device.

How Biometric Authentication Works

1. Enrollment: the trait is captured once, for example by placing the finger several times.
2. Create a template: the system does not store an image, but a mathematical description of the traits, the so-called template.
3. Compare: at every login, the trait is captured again and compared with the template.
4. Decide: the result is never an exact match, but a similarity score. If it is above a threshold, the person is accepted.

Accuracy: FAR and FRR

Biometrics works with probabilities. Two figures describe the quality:

• False acceptance rate (FAR): how often is a stranger wrongly accepted?
• False rejection rate (FRR): how often is the right person wrongly rejected?

The two are linked. If the threshold is stricter, the FAR falls, but the right people are rejected more often. If it is looser, convenience rises, but so does the risk. The vendor must find a sensible balance here.

Benefits

• Convenient: no password to remember, no card to look for.
• Fast: login often takes less than a second.
• Hard to pass on: a fingerprint cannot simply be sent by email or guessed.
• Easy to combine: as a second factor in multi-factor authentication, biometrics greatly raises security.

Risks and Attacks

• Fakes: attackers try fake fingerprints, photos, videos or masks.
• AI fakes: deepfakes and voice clones threaten face and voice recognition over video or phone in particular.
• Cannot be changed: you can change a stolen password. Not your fingerprint. A data leak with biometric templates is therefore especially serious.
• Error rates: injuries, glasses, masks or poor light can lead to rejection.
• Forced use: a finger can be pressed onto a sensor against a person's will.

Liveness Detection

Good systems check whether a living person is really in front of the sensor. This liveness detection looks at things such as depth, skin texture, blood flow, blinking or small movements. It makes attacks with photos, masks or fake fingers much harder. The ISO/IEC 30107 series of standards covers how to test this.

Biometrics and Passkeys

Biometrics is especially secure when the data never leaves the device. That is exactly what happens with passkeys under the FIDO2 standard. The fingerprint or face only unlocks a key stored in a protected area of the device. The server learns nothing about the biometric trait. It only receives a cryptographic confirmation.

This removes the biggest risk of centrally stored biometrics. At the same time, passkeys protect against phishing, because they only work on the real website. The central sign-in of SecTepe.Comm also supports passkeys as a second factor.

Data Protection and Law

Biometric data that uniquely identifies a person is specially protected under Article 9 of the GDPR. Processing it is only allowed with an exception, for example explicit consent.

In employment, consent is tricky because staff depend on their employer. Companies should therefore offer an equal alternative, such as a chip card. Before rollout, a data protection impact assessment is usually needed, and the works council must be involved.

The EU AI Act also sets limits. For example, it bans emotion recognition in the workplace and strictly limits remote biometric identification in public spaces.

Best Practices

• Store locally: keep biometric templates only on the device, not in a central database.
• Combine with another factor: use biometrics as part of MFA, not as the only protection for critical systems.
• Require liveness detection: only use systems with tested detection of fakes.
• Offer an alternative: for people for whom biometrics does not work or who refuse it.
• Clarify data protection early: legal basis, impact assessment and co-determination before the start.

Conclusion

Biometric authentication makes login convenient and fast. It is secure when the data stays on the device, good liveness detection blocks fakes and biometrics is combined with another factor. Passkeys show how to do this well. Because biometric data is so sensitive, data protection must be part of it from the start.