Biometrics and Token-Based Authentication

Biometric authentication verifies identity based on unique physical or behavioral characteristics — 'something you are.' Unlike passwords, biometrics cannot be forgotten, shared easily, or lost. However, they also cannot be changed if compromised: you cannot get a new fingerprint. Biometric systems measure and compare a biological or behavioral trait against an enrolled template stored during setup. The quality of a biometric system is measured by its error rates and the security of how templates are stored. Biometrics are most powerful when combined with another factor (e.g., fingerprint + PIN).

Physiological biometrics are based on physical characteristics of the body. Key types include: Fingerprint: most widely deployed due to low cost and acceptance; used in phones, access control, and border security. Retinal scan: scans blood vessel patterns on the back of the eye — very accurate and hard to spoof, but requires close contact with the reader. Iris scan: scans patterns in the colored part of the eye — can be done from greater distance, used in airports. Facial recognition: analyzes facial geometry from a camera; increasingly accurate but can be affected by lighting, aging, and disguises. Hand geometry: measures hand shape and finger length.

Behavioral biometrics analyze patterns in how a person does something, rather than physical characteristics. Examples include: Keystroke dynamics — measuring typing rhythm, speed, and dwell time on keys (how long each key is held). Mouse dynamics — speed, acceleration, and movement patterns of mouse usage. Voice recognition — analyzing speech patterns, pitch, and cadence (distinct from voice commands). Signature dynamics — pressure, speed, and rhythm of handwritten signature, not just the shape. Behavioral biometrics are particularly valuable for continuous authentication — verifying identity throughout a session, not just at login.

Two error rates characterize biometric system performance. False Acceptance Rate (FAR): the probability that the system incorrectly accepts an impostor as a legitimate user — a security risk. False Rejection Rate (FRR): the probability that the system incorrectly rejects a legitimate user — an availability/usability issue. These rates are inversely related: increasing sensitivity reduces FAR (fewer impostors accepted) but increases FRR (more legitimate users rejected). The Crossover Error Rate (CER) — where FAR equals FRR — is the single number used to compare biometric system accuracy. Lower CER = more accurate system.

Biometric systems are not immune to attack. Spoofing attacks present a fake biometric to fool the sensor: fingerprint spoofing uses gelatin or silicone copies of a latent fingerprint; facial recognition can be fooled by high-quality 3D masks or photos in lower-quality systems. Template database attacks: if the stored biometric templates are stolen, they cannot be revoked like passwords. Modern systems mitigate this through template protection (storing hashed or transformed templates rather than raw biometric data) and liveness detection (proving the biometric is from a live person, not a copy).

Hardware security keys like YubiKey, Google Titan Key, and SoloKey implement the FIDO2/WebAuthn standard for phishing-resistant authentication. The key contains a hardware-protected private key that performs cryptographic operations without the key ever leaving the device. When authenticating, the challenge from the website is signed by the hardware key's private key — and because the operation is bound to the specific website origin, a MITM phishing site cannot intercept or relay the authentication. Hardware keys can also function as PIV smart cards for enterprise environments requiring certificate-based authentication.

Smart cards are credit card-sized devices with an embedded microchip that stores cryptographic keys and certificates. PIV (Personal Identity Verification) cards are the smart card standard mandated for US federal government employees (FIPS 201). PIV cards contain: the holder's X.509 certificate, their private key (which never leaves the card), a digital photograph, and biometric data. Authentication requires both the physical card ('something you have') and a PIN ('something you know'), creating two-factor authentication. Smart cards are read by contact or contactless (NFC) readers.

One-Time Passwords (OTP) are authentication codes that are valid for only one use. Two standards exist. HOTP (RFC 4226): HMAC-based OTP that increments a counter each use. The authenticator and server must stay in sync; if codes are generated but not used, they can drift out of sync, requiring re-synchronization. TOTP (RFC 6238): Time-based OTP that uses the current time as the counter, changing every 30 seconds. TOTP is more popular because it self-syncs via time; the authenticator and server only need to agree on the current time (NTP helps). Unused TOTP codes simply expire.

Push authentication (used by Duo Security, Microsoft Authenticator, Okta Verify) sends a push notification to the user's smartphone when a login attempt is detected. The user approves or denies the request with a tap — much simpler than entering a 6-digit code. Some implementations display login context (IP address, location, application) so the user can make an informed decision. The security weakness: MFA fatigue attacks — attackers flood the user with rapid push requests hoping the user accidentally approves one, or approves just to stop the notifications. Countermeasures include number matching (user must enter a code shown on the login page) and additional context in the push notification.

Adaptive authentication adjusts the required authentication strength based on context signals. If a user logs in from their normal device, on the corporate network, during business hours — low risk, password alone may suffice. If the same user logs in from a new device in an unknown country at 3 AM — high risk, step-up authentication is triggered (requiring MFA or manager approval). Context signals include: device fingerprint (known/unknown), IP geolocation, time of day, impossible travel (logins from two locations impossible to travel between in the elapsed time), and behavioral patterns. This reduces MFA friction for low-risk logins while adding friction where it matters most.

Passwordless authentication eliminates the password entirely, using phishing-resistant factors instead. Common approaches: FIDO2/WebAuthn with biometrics (Windows Hello, Touch ID) or hardware keys; magic links (a one-time URL sent to the user's email or phone, effective when email access is trusted); and passkeys (the FIDO Alliance standard adopted by Apple, Google, and Microsoft where the private key is stored in the device's secure enclave and synced to the cloud via the vendor's account). Passkeys combine convenience with phishing resistance and are rapidly being adopted as the successor to passwords.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: biometric authentication uses physiological (fingerprint, iris) or behavioral (keystroke, voice) traits; FAR and FRR measure biometric system accuracy with CER as the balance point; hardware security keys (FIDO2/WebAuthn) provide phishing-resistant token-based auth; and adaptive authentication adjusts friction based on context risk. Next up we explore Authorization Models: RBAC, MAC, and DAC.