When Your Password Is Your Face
Biometric authentication (fingerprints, facial recognition, iris scans, voice recognition) is promoted as more secure than passwords. But biometrics have a fundamental weakness: you can't change them if compromised.
Attack Types
Presentation Attacks (Spoofing)
Fingerprint:
- Lifted prints from surfaces (glass, phone screens)
- 3D-printed fingerprint molds
- Gelatin or silicone replicas
- Conductive ink prints
Facial Recognition:
- High-resolution photos held to camera
- 3D-printed face masks
- Video replay attacks
- Deepfake face generation
Voice:
- AI voice cloning from samples
- Recorded voice replay
- Text-to-speech with voice style transfer
Iris:
- High-resolution iris photographs
- Contact lenses with printed patterns
- Prosthetic eye replicas
Liveness Detection Bypass
Anti-spoofing measures and their weaknesses:- Blink detection: Defeated by video or animated images
- 3D depth sensing: Defeated by 3D masks
- Challenge-response: Defeated by real-time deepfakes
- Blood flow detection: Most effective but expensive
Template Attacks
If biometric templates are stolen from databases:- Templates cannot be "reset" like passwords
- Cross-matching across systems
- Reconstruction of biometric data from templates
Best Practices
Multi-Modal Biometrics
Combine multiple biometric factors:- Fingerprint + face + behavioral (typing pattern)
- Significantly harder to spoof all simultaneously
Biometrics as One Factor
Never use biometrics as the sole authentication factor:- Biometric + PIN/password
- Biometric + hardware token
- Biometric + behavioral analysis
Template Protection
- Store encrypted templates, not raw biometric data
- Use cancellable biometrics (transformed templates)
- Implement template aging and re-enrollment
- Never store biometric data in the clear
Liveness Detection
- Multi-spectral imaging
- 3D depth cameras
- Behavioral liveness (micro-expressions, eye movement)
- Challenge-response with randomized prompts
Where SuperClue Fits
SuperClue does not test biometric systems or liveness detection. Its DAST scanner tests the web applications and APIs that handle biometric enrolment and login.