I'm currently working on an Android app in which I want to authenticate someone against an REST API. I want to do this as secure as is (cost-)effective/possible/user friendly.
I've been looking around and found that 2FA (two factor authentication) seems the most viable solution (after initiating the sign up process I'll send a POST to the REST API to store device data and give the device a token that is generated from the device information and then send an SMS with a different token to the phone which the user then has to enter (likely TOTP)). SSL is used whilst communicating with the remote API.
My question to you is, is it worth the effort to look into biometrics? There are just so many possibilities to do this:
- Finger prints (seems very unsafe. Mythbusters 2006 episode)
- A picture of the user (since a 'selfie' is a thing, but has to be monitored if no proper matching software is found).
- and I'm probably forgetting a few more now...