1

There are lots of resources discussing the security of fingerprints but I haven't been able to find the answer to a very basic question.

In the simplest possible password authentication scenario, the password is sent from the client to the server, and the server verifies it is correct. therefore if someone doesn't know the password they can't get access.

However with fingerprints, as far as I understand the fingerprint is only ever stored on the device itself and therefore the device is responsible for verifying that the fingerprint is correct. So how can the server be sure that the device has actually verified the fingerprint and isn't simply a fake that always returns "fingerprint valid = true"?

6
  • 1
    A fingerprint can't be used for initial login, only to resume a session that was initially established, on the same device, with username and password. So the particular device is trusted, but the account owner has made the choice to trust that device by typing their credentials into it. The system isn't blindly trusting every device in the wild.
    – Ben Voigt
    Apr 6 at 15:54
  • Isn't a fingerprint just an extractable sequence of biometrics that is used as a passcode? That means it's as secure as a password submission mechanism, plus you don't have as much of an issue coming from poorly chosen or keylogged passwords.
    – Adam Katz
    Apr 6 at 15:54
  • @AdamKatz: How does your comment handle the (almost universal) case where no biometric information is allowed to leave the end device? Also no, a fingerprint doesn't give a reproducible sequence, every read will produce different data. So it can't be used as a passcode, only as an alternative to a passcode.
    – Ben Voigt
    Apr 6 at 15:57
  • @BenVoigt – Good to know. That's why I didn't make an answer and posed my comment as a question. AFAIK, biometrics have to have a fuzzy tolerance, but can match to an embedded code either derived from the fingerprint or else tied to a key (which does indeed require trust).
    – Adam Katz
    Apr 6 at 16:13
  • 1
    Usually the password is stored on the secure enclave, the fingerprint allows the password to be extracted and sent. So server receives the password, not the fingerprint data.
    – ThoriumBR
    Apr 6 at 16:46

1 Answer 1

3

It all depends on how it is implemented. A naive implementation might have the user's finger template stored server-side, and send the user's fingerprint to the server every time for authentication.

Better implementations will use standards like FIDO, which rely on public key cryptography. When a user registers with a service, the FIDO client generates a public-private key pair, sends the public key to the service and securely stores the private key on the device. Subsequently, whenever the user attempts to authenticate themselves to the service, the service will send the user a random challenge. The user's FIDO client will sign the challenge with the private key and send it back to the server. The server will verify the signature with the public key, and if it is valid, the user will be authenticated.

Notice that this process does not prove validity of the fingerprint, it only proves that the client is in possession of the original private key. Validating the fingerprint is up to the client, which is typically done by storing the private key and fingerprint template in a separate tamper-resistant device or secure enclave. Validation of the fingerprint and signing of authentication challenges is also done in the secure enclave, so that external malicious processes cannot interfere. It is the user's job to ensure that they only use trustworthy clients. This is not unlike traditional password based systems where using a malicious client also results in the password being compromised.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.