Biometrics Unlocked: How Your Unique Traits Are Replacing Passwords in the Digital World

In today’s digital world, we are deeply integrated into online activities, from work, to entertainment and numerous utility purchases. With each click and transaction, our personal data becomes increasingly fragmented and vulnerable to breaches.

This fragmentation underscores the need for businesses to innovate their data gathering practices. Consent-based data exchanges, driven by zero-party data, are revolutionising business-consumer interactions. Unlike traditional data types—third, second, and even first-party data—zero-party data involves explicit consumer consent, which is crucial for delivering personalisation while respecting consumer data privacy.

The emergence of technology built on open standards empowers consumers to take control of their own data, allowing them to share their data with explicit consent seamlessly. This portability of securely stored personal data enhances customer experiences, providing convenience and ease, such as onboarding new users with just a click.

As we adopt these innovative data collection methods and unlock rich insights, it is imperative to evaluate and enhance data protection practices to build trust and foster better business-consumer relationships.

The Honey Pot

Storing all your vital information in a single central location with a business is akin to putting all your eggs in one basket, thereby making it a prime target for unlawful activities and potential identity theft. As we transition towards models where consumers take ownership of their own identity and data, this centralised storage approach is becoming obsolete. 

Now, individuals store their critical data—such as IDs, financial records, health, employment, and education details—locally on their own devices, be it mobile phones or personal computers. This decentralisation significantly enhances privacy but also introduces new challenges in ensuring that each consumer's data is securely safeguarded against threats. Even though the data is now physically with the consumer, this 'honeypot' must still be effectively protected. 

Thus, the use of PINs or passwords becomes essential. However, the challenge remains: how many passwords are too many? To reduce our mental load, we often opt for passwords that are easy to remember, which unfortunately also makes them easier for hackers to guess.

The Shift from Passwords to Biometrics

Forgot Password? A dreaded phrase we wish we never have to come across again. Well, the future is here. Your consumers can now authenticate themselves with a wink or a smile.

Hardware and software innovations in conjecture are driving the world to an elevated path of authentication. Utilising a consumer’s physical attributes to prove their authenticity offers enhanced security and a unique user experience. The convenience of biometric authentication makes it an easy choice to grant access to your devices and applications.

In this blog, we explain how biometric authentication can help safeguard your consumers’ data. We will also learn how your application can leverage existing device capabilities – hardware and OS, as well as easily available APIs to provide your consumers with a secure and seamless way to authenticate themselves. 

Get ready to embark on a journey into the future of authentication technology.

Biometric Authentication – The Basics

Biometric Authentication utilises a person’s unique physical or behavioral attributes like fingerprint, facial features, eyes – your biometrics to verify your identity. It is like having a built-in security system in your body, for critical information. It is secure and convenient, better than a password or a PIN, since it does not rely on memory. 

Why do we need Biometric Authentication?

Biometric authentication is quickly becoming an integral part of our daily routines, enabling us to unlock our phones, facilitate payments, and much more. Let us delve into the intricate process that occurs behind the scenes when you authenticate using your biometrics. Consider your device’s operating system (OS) as a secured vault. When you unlock your phone using your fingerprint or facial recognition, the OS springs into action, processing your biometric data.

Key benefits and advantages of biometric authentication include:

• Secure Shielding: Your unique biometric data, such as fingerprint patterns or facial features, is encrypted and securely stored within the device’s hardware, separate from the main OS. This provides an additional layer of protection against unauthorised access.
• Secure Data Transmission: When your biometric data needs to be transmitted (for instance, during server authentication), the OS encrypts it, ensuring that only authorised entities can decode the information. This keeps your data safe from malicious actors.
• Safeguard Against Threats: The OS has special secure zones, known as Trusted Execution Environments (TEEs), which handle the processing of your biometric data. This isolated environment safeguards your data from potential threats, even if your device is compromised.

Fun Fact: Did you know that some biometric systems operate entirely offline? This means that your fingerprint or facial scan never leaves your device, significantly reducing the risk of data interception.

Ready to Unlock the Future?

Most major device platforms offer robust biometric authentication features. Here is a quick peek at some popular APIs for you to get started:

iOS and macOS

Local Authentication Framework: This framework provides APIs to authenticate users using biometrics (Face ID or Touch ID) or a user’s passcode.

Android

Biometric API: Android’s Biometric API allows for secure authentication on the Android platform. It supports various authentication types, including biometric ones such as fingerprint and face, as well as non-biometric types like PIN, password, and pattern recognition. 

Windows

Windows Biometric Framework (WBF): WBF provides a set of APIs that allows client applications to capture, compare, and store biometric data without gaining direct access to any biometric hardware or samples.

Web Authentication 

WebAuthn API

This API is supported by every major browser and links a friendly JavaScript API to a variety of hardware-based authentication methods, including biometric options supported by desktop and mobile operating systems.

So, ditch the password headaches and embrace the future of secure and convenient access with biometric authentication.

How Does Biometric Authentication Work?

We now know that allowing users to authenticate using biometrics offers substantial benefits in both security and convenience.

Here is a simple workflow of how this works:

Where to Start?

For web applications, the easiest framework to implement biometric authentication will be WebAuthn. It is based on public key cryptography, allowing servers to register and authenticate users using their public key instead of the traditional password. This method not only simplifies the authentication process but also enhances the security of user data.

What is Public Key Cryptography?

Public key cryptography was invented in the 1970s as a solution to the problem of shared secrets. It is a pillar of modern internet security; for example, every time we connect to an HTTPS website, a public key transaction takes place.

Public key cryptography utilises the concept of a keypair: a private key that is stored securely with the user, and a public key that can be shared with the server. These "keys" are long, random numbers that have a mathematical relationship with each other.

Like in traditional password-based authentication, the application presents a form to the user to first register with their credentials, usually a user ID and creating a password. Then, for logging in, the application presents a form where the user must provide the same credentials to get authenticated.

In a comparable manner, WebAuthn provides APIs which help application developers to 'Register' a user and then authenticate the registered user for logging-in.

Registration of a User with WebAuthn

This is the start of a journey towards a more secure authentication mechanism. WebAuthn APIs assist in creating and using public key credentials. Instead of an application server managing and storing the password, the credentials belong to the user and are managed by the WebAuthn Authenticator.

The following components are involved in this process:

• Public Key Credentials: These are the user credentials that are cryptographically secure. They belong to the user and are used to authenticate them.
• WebAuthn Authenticator: This is a device or software that manages the user’s credentials. It could be a hardware device like a security key, or a software-based system like a password manager or even an operating system service.
• WebAuthn Relying Party: A website or web service that seeks to authenticate a user. The Relying Party engages with the Authenticator via the user’s platform, including web browsers and mobile devices.
• Client Platform: This is the user’s device and software environment. It could be a desktop computer with a web browser, a smartphone, or another type of device.
• Relying Party Scripts: These are scripts running on the Relying Party’s website. With the user’s consent, these scripts can ask the client platform to create a new credential. This new credential can then be used for future authentications.

When a user visits a website that uses WebAuthn (the Relying Party), it can ask user’s device (the Client Platform) to create a new, secure credential (managed by the Authenticator). Once created, this credential can be used to prove the user’s identity in the future. This all happens with the user’s consent and provides a secure method of authentication better than traditional passwords.

Authentication of a User with WebAuthn

After the registration has finished, the user is authenticated. During authentication, an assertion is created, which is to proof that the user has the possession of the private key. This assertion contains a signature created using the private key. The server uses the public key retrieved during registration to verify this signature.

Let's understand the components involved in the WebAuthn authentication process:

• Authentication: This is the process where a user proves their identity to a system. In WebAuthn, this involves demonstrating that the user holds the private key associated with their account.
• Assertion: A statement from the user’s authenticator that serves as proof of possession of the private key. It is generated during the authentication process.
• Signature: The assertion includes a signature, which is a piece of data created with the private key. The signature is unique and can only be generated by someone who has access to the private key.
• Verification: The server (or Relying Party) verifies the signature using the public key retrieved during the registration process. Due to the mathematical relationship between the public and private keys, if the signature correctly verifies with the public key, it confirms that the signature was indeed created with the associated private key, thus authenticating the user.

Verification looks different depending on the language and cryptography library used on the server. However, the general procedure remains the same.

• The server retrieves the public key object associated with the user.
• The server uses the public key to verify the signature, which was generated using the authenticatorData bytes and a SHA-256 hash of the clientDataJSON.

So, in simple terms, during authentication, the user’s device (with biometric hardware acting as the authenticator) creates proof (the assertion) that it holds the user’s private key, without ever revealing the key itself. This proof includes a signature made with the private key. The website the user is trying to authenticate with (the Relying Party) checks this proof by using the public key it has on file from when the user registered. If everything checks out, the server knows that it is the same person who registered earlier, and thus it authenticates. This process provides an elevated level of security.

Biometric Authentication in WebAuthn:

At the first glance, securely authenticating a user with WebAuthn might seen complicated. It can be easy to lose track of how biometrics come into play here. Remember, during registration, a PublicKey is sent to the relying party by the user. The corresponding PrivateKey is stored on the user’s device, whether it is a desktop or a mobile. Depending on the hardware support, this PrivateKey is secured by biometric data, such as a fingerprint or a Face ID.

When the user attempts to log in and create a signature, the PrivateKey is needed. At this point, the user’s device prompts biometric authentication to verify the ownership of the key created during registration. Once the user is authenticated, the PrivateKey is used to sign the payload, which is then sent to the relying party. This process ensures a secure and verified transmission of user data.

1. During registration, a PublicKey is sent to the relying party, and the corresponding PrivateKey is stored on the user’s device.
2. This PrivateKey is secured by biometric data (such as a Fingerprint or Face ID), depending on the device’s hardware capabilities.
3. When the user attempts to log in, the device prompts biometric authentication to verify the ownership of the key.
4. Once the user is authenticated, the PrivateKey is used to sign a payload, which is then sent to the relying party.

This process ensures that the user’s identity is securely verified during transactions. However, the exact implementation can vary based on specific technologies and protocols used. It is always a good idea to refer to specific documentation or standards when implementing such systems.

Embrace the Simplicity of Biometrics with Affinidi Login

Enabling biometric authentication and understanding specifications is a daunting task if you are new. With Affinidi, developers can leverage easy to implement tools and solutions to quickly build secure applications with password-less authentication. They also utilise the user’s device for biometric authentication. This is made possible with Affinidi Login – a key product of the Affinidi Trust Network, for building transparent and secure data exchanges. 

Affinidi Login simplifies the implementation of password-less authentication which includes the uses biometrics to authenticate users and prove users own and control the device they are using to log in. It enhances security, privacy, and ensures compatibility with industry standards to create a user-friendly login experience with integrated biometric authentication.

By implementing Affinidi Login, you can provide your user with a secure, seamless, and transparent authentication method that also leverages biometrics as a default. Thus, the often-complex process of implementing biometric authentication is alleviated. It is a great way to enhance the security of an application while also improving the user experience.

Begin your journey to implement biometric authentication with Affinidi Login by exploring Affinidi’s comprehensive documentation and resources.