2

Usual password authentication systems do not store passwords directly on the server, but only hashes of those passwords. Why do fingerprint authentication systems not offer this possibility?

1

1 Answer 1

3

Password authentication systems check for full equality. If you make a typo in your password, you will not be authenticated*.

You cannot check a fingerprint for full equality; it's a 'scan' and there will always be some minor differences: perhaps you have a small cut in your finger, or you put your finger slightly rotated on the device and the digitalization process displaces a few pixels.

A hash is designed to implement the avalanche effect; a small change in the input causes a large difference in the output. That means that two slightly different passwords or two slightly different fingerprints produce two completely different hashes. If you have the hash of a fingerprint, there's no way of verifying whether it matches a slightly different fingerprint.

*: such a verification system would work by verifying the hash with not only the hash of the actually entered password, but also the hash of all possible typos.

1
  • I believe Facebook implements an authentication system similar to what you described about typos. Jul 3, 2020 at 19:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.