Where I work, this is the passwordless registration/login flow for our Mobile App

  1. A user registers with a username and a phone number. An SMS OTP is sent to the phone number to verify it.
  2. Initial login: The user logs in to the mobile app with its username. The app sends an OTP code to the registered mobile number.
  3. After login, the app prompts the user to enable a Biometric factor and a PIN as fallback for enhanced security
  4. Next time the user logs in, he has to be in possession of the phone number (first factor) and complete the Biometric challenge (second factor).

The process seems pretty standard. We have

  • Initial login
    • Username + Mobile OTP (something you have)
  • Subsequent Logins
    • Biometric/PIN (something you are or know) bound to something you have (the mobile device where the biometric/PIN is setup)

But how is the biometric bringing any security value beside being more "user friendly" than the PIN. If the biometric fails it falls back to the PIN. So the PIN is the real factor.

Now consider the following threat

Your phone get stolen. The first security factor is now compromised. The thief can access the mobile app in two ways:

Access the account from the stolen device

  1. If the phone is locked by a PIN, then the App is already protected by the device PIN
  2. In case of phone jacking, the PIN might be known to the thief, putting the app behind a biometric/PIN is useless.

Perform a first-time login from another device with your SIM card

  • The thief can do a SIM Swap and first-time login on a new device by receiving the OTP on the SIM. In that case, the biometric/PIN is not a safeguard anymore.

A third solution would be to ask the user to input a user-defined PIN that is stored remotely on my backend. But then, it is not bound to the device anymore. It becomes a simple password.

So, how biometrics is supposed to improve security? What is the correct workflow used by banks?

  • 1
    Biometrics are convenient not really that secure. And convenience is actually a very good property because 90% of the people are extremely lazy in terms of security.
    – Bakuriu
    Jan 20 at 8:33
  • Anyway when comparing security you need first define your threat model. What can the attacker do and what can't they do? What does the attacker know? If in your scenario you assume that the attacker can know any PIN/password of the user, that they can steal/infiltrate the user device, that they can SIM swap any SIM etc then you will end up to the conclusion that you should not secure your application at all because there is no way to win and anything you do is useless... but is this a reasonable scenario?
    – Bakuriu
    Jan 20 at 8:36
  • So the PIN for the app is pulled from the PIN from the device? That's not clear from your description. Or is the biometrics/PIN step simply the local device authentication? You need to make it clearer what is doing the authentication of the biometrics and PIN. Your threats from a stolen device aren't clear. Consider also the trend of stealing a phone while it's in use, meaning the thief gets an unlocked phone.
    – schroeder
    Jan 20 at 10:13
  • Your SIM swap scenario also has some problems: 1. SMS OTP has long been considered insecure. 2. you don't mention a process to authorise an existing account on a new phone when it has already been set up. That's not biometrics' fault.
    – schroeder
    Jan 20 at 10:19
  • Rule of thumb (literally): biometrics doesn't work as a secret (e.g. a password), biometrics works to re-enforce identity (e.g. username).
    – schroeder
    Jan 20 at 10:22


You must log in to answer this question.