Face ID or Fingerprint? How Security Teams Decide What to Trust

When we talk about mobile security, we often ask which is more secure? Face ID or fingerprint authentication?

Photo by https://unsplash.com/@marcohaenssgen Marco J Haenssgen on Unsplash

But security teams usually ask a very different question

What authentication system gives us the right balance of security, usability, hardware capability, privacy, and resistance to attack?

As we may notice, Apple chose to make Face ID the primary biometric system on most modern iPhones, while many Android devices continue to rely on fingerprint authentication, and even sometimes alongside facial recognition! ..

At first glance, that may look like two companies disagreeing about which biometric is safer, but it is actually more complicated. Let’s breaks this down ..

First: Android does not have one biometric strategy

One important distinction is that Apple and Android are not equivalent ecosystems, Apple controls the operating system, processor, biometric hardware, secure hardware, and device design of the iPhone. Android, on the other hand, runs across devices produced by many manufacturers, meaing, they are not only having Andorid for only one type of mobile phones ..

Android currently defines biometric authenticators using categories including Class 3 (Strong), and Class 2 (Weak), knowing that applications can even request a particular strength through Android’s BiometricPrompt APIs ..

And this is a very important security-engineering idea, that Android is interested not only in what biometric you use, but in how securely that biometric is implemented, that:

A fingerprint system can be strong, and on the other side, a facial recognition system can be strong too ..

And either one of them can also be poorly used in the system! ..

Google describes two major considerations when evaluating biometrics: the security of the biometric architecture itself and its resistance to spoofing attacks.

Second: Apple’s approach controls the entire authentication chain

Apple approaches the same problem from a different position, because Apple controls both the hardware and software of the iPhone, it can design an authentication system as one integrated security architecture, meaning, Face ID does not simply take a normal selfie and compare it with another photo! Apple’s TrueDepth system projects and analyzes thousands of infrared points to construct depth information about the face. Then the resulting mathematical representation is processed and protected by the Secure Enclave. Apple also uses anti-spoofing mechanisms designed to resist attempts involving photographs or masks ..

Apple says that, for Face ID with a single enrolled appearance, the probability of a random person being accepted is less than 1 in 1,000,000. And for Apple’s Touch ID, the corresponding figure published by Apple is approximately 1 in 50,000 for one enrolled fingerprint ..

But that does not automatically mean face recognition is always twenty times more secure than fingerprint recognition, those numbers describe Apple’s particular implementations under Apple’s stated conditions! ..

Then why do many Android phones still use fingerprints?

Because fingerprint authentication has some very attractive properties, it can be fast, inexpensive to integrate, familiar to users, and practical in many environments, and it also does not require a complex 3D facial-sensing array ..

Google’s Pixel devices, for example, support fingerprint authentication, and newer Pixel devices can also support Face Unlock. Google stores biometric information locally and protects fingerprint processing within secure hardware environments rather than sending fingerprint information to Google or applications ..

THEN THE REAL QUESTIONS ARE

What security architecture do we have?

How much battery will the authentication system consume?

How much space will its sensors require?

Will it work in darkness?

Will it work when someone is wearing gloves?

Will it work when the user is wearing a facial mask?

How expensive is the sensor?

Can it fit inside hundreds of different phone designs?

Apple’s question may be different from Google’s

Apple may ask this question: We control the device, then what biometric architecture do we want this device to have?

Get Nayra Hashem’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

And Android will ask something closer to: How do we create security requirements that can work across many hardware manufacturers?

But CAUTION, your biometric is not actually your password!

Neither Apple nor Android treats biometrics exactly like an ordinary password, because:

• Your password is something you know ..
• Your phone is something you have ..
• Your fingerprint or face is something you are ..

NIST explicitly notes that biometric characteristics are not secrets, faces can be photographed, fingerprints can be left on surfaces. Android describes biometrics as a secondary authentication tier, while the user’s PIN, pattern, or password remains primary authentication, and Apple follows a similar principle, that Face ID and Touch ID improve convenient access, but they do not eliminate the device passcode ..

Convenience is part of security

Shouldn’t security teams simply choose the strictest possible authentication system? Not necessarily! ..

Imagine a phone that required a 30-character password every time you opened WhatsApp, technically, that might increase authentication friction, but in reality, users would probably find ways around it, like:

• They might choose weaker passwords ..
• They might disable protections ..
• Or they might avoid locking the device frequently ..

Security engineers therefore care about something called usable security. Apple itself explains biometrics partly in these terms: users may access their devices more than one hundred times per day, so biometric authentication makes strong device protection practical without requiring the password every time ..

That’s why, a good security engineer will ask:

What security will people actually use?

And not only:

What is theoretically strongest?

Security standards define outcomes, not always technologies

This is one of my favorite lessons from this comparison, standards organizations often avoid saying: You must use fingerprint authentication, or You must use facial recognition, instead, they define measurable security properties. For example, NIST’s current digital identity guidance specifies requirements around biometric false-match rates and presentation-attack detection. For facial recognition, presentation-attack detection is explicitly required in the relevant authentication guidance ..

So ASKING now: Apple or Android approach?

But this is probably the wrong question to be asked! Apple and Android are solving slightly different engineering problems, Apple operates a tightly controlled hardware and software ecosystem, and that allows the company to build specialized hardware such as TrueDepth and integrate it directly with the Secure Enclave and operating system.

While Android operates a much more diverse ecosystem, its security framework therefore needs to support fingerprints, or faces while evaluating them according to their actual security strength.

So the real ANSWER is

Security decisions are made by examining the entire system:

• The hardware ..
• The operating system ..
• The attacker possible methods ..
• The user ..
• And the cost of failure ..

And that is where security engineering becomes much more interesting than a settings screen! ..

#flutterPavilion #state02 #starCode #hashem_nayra 💙✨