2.5 Biometrics: convenience vs coercion

The irreversible factor

Passwords and PINs are secrets you can rotate. Biometrics are measurements of your body or behaviour that you carry for life.

Even when a device stores only a mathematical template rather than a full image, that template represents features stable enough to be matched in future. Once a template is copied beyond your control, or inferred from public data, you cannot meaningfully revoke or replace the trait behind it.

Modern systems reduce the risk by keeping templates inside secure hardware (often called a secure enclave or trusted platform module). Matching happens inside that chip, and apps only get a yes or no. That keeps raw biometric data away from ordinary software.

It does not remove all risk, though. If an attacker unlocks the device itself, they bypass the protection wherever the template is stored.

Fingerprints, face recognition, and voice

Fingerprints. Sensors capture ridge patterns and minutiae points, then derive a template for quick matching.

• Capacitive sensors check the electrical properties of skin.
• Optical and ultrasonic sensors read surface or sub-surface detail to improve reliability.

The false acceptance rate (letting the wrong person in) and false rejection rate (locking out the right person) are engineering trade-offs chosen by the manufacturer. Cold fingers, moisture or minor cuts can cause failed matches. High-quality casts or lifted prints can sometimes fool simpler sensors, though consumer devices increasingly detect liveness by measuring skin properties.

Face recognition. The system turns an image into a face embedding: numbers describing features such as distances between key points and texture. Good systems check liveness using infrared depth, micro-movement or anti-spoofing checks to resist photos and masks.

They can still struggle with:

• twins;
• some make-up styles;
• medical masks;
• glare, and lighting in general (performance depends heavily on it).

Many consumer systems lower sensitivity to make unlocking fast, which can raise the chance of a false accept in edge cases.

Voice. Systems record timbre, pitch and articulation patterns to build a voiceprint. Handy for hands-free use, but open to replay: high-quality recordings or synthetic speech can get through unless liveness checks spot challenge-response phrases, background consistency and spectral artefacts. Background noise and illness increase false rejections. And in public or shared spaces, speaking a passphrase can give information away to bystanders.

Why biometrics cannot be changed

A biometric is not a secret you remember; it is a measurement the world can often observe.

• Your face appears in photos.
• Your fingerprints can be lifted from objects.
• Your voice is recorded in meetings.

Templates are still derived from features linked to you, and "changing" the template just re-measures the same trait. If an attacker gathers enough to build a working model, there is no practical way to make that trait not yours.

That shapes good design:

• Use biometrics as an unlock signal that stays local to a device, not a network credential that can be replayed elsewhere.
• Prefer systems where the biometric never leaves secure hardware and cannot be exported.
• Prefer systems where compromise sends you back to a PIN or password, rather than permanently losing an account.

Legal differences: knowledge vs body‑based authentication

UK law draws a practical line between what you know (a password or PIN) and what you are (a fingerprint or face).

In several contexts, compelling you to disclose knowledge engages different rights from physically using your body to unlock something. Police powers and court orders work within specific frameworks, and outcomes depend on circumstances. But a recurring theme is that body-based unlocking can be easier to compel than disclosure of memorised secrets.

Day to day, that changes your risk:

• Biometric lock: someone could physically press your finger or hold up your face.
• PIN known only to you: compelling disclosure generally needs stronger legal processes and is harder to do covertly.

That is why organisations handling sensitive data commonly advise switching to a PIN or password before border crossings or high-risk encounters where compulsion might happen.

Forced unlocking risks

If your body is present, your biometrics can be used without your consent.

• At a busy event, a stolen phone held up to your face while you are distracted.
• During a robbery, a finger forced onto a sensor.
• At home, family pressure blurring what consent means.

None of these needs you to say a secret, and it can all happen quickly and be hard to contest in the moment.

Device features help:

• Panic gestures: many devices let you press specific buttons to disable biometric unlock until the next PIN entry.
• Attention checks: some systems require eyes open and focused, reducing unconscious unlocking.
• Short timeouts that fall back to a PIN after inactivity shrink the window for coercion.
• On laptops, allow biometric unlock only after a boot-time password has been entered, so a cold-booted device cannot be opened by biometrics alone.

Your own habits matter too. Expecting heightened risk (travel through jurisdictions with wide search powers, protests, sensitive meetings)? Temporarily disable biometric unlock and rely on a strong, well-memorised PIN or passphrase. Keep recovery contacts and backup codes offline so that turning biometrics off does not strand you.

Why biometrics suit devices better than accounts

Biometrics are strongest when they never leave the device and act only as a local convenience layer above a stronger secret.

Phones with secure enclaves, modern Windows and macOS laptops, and some hardware tokens match the biometric inside tamper-resistant hardware and pass a yes/no signal to the operating system. If the phone is wiped or stolen, the biometric cannot be reused to log in anywhere else.

Using biometrics directly for online accounts is another story. A service that accepts a fingerprint or faceprint over the network has to store a copy or comparable template. Breach that store and you cannot change your fingerprint the way you would change a password.

Even where standards exist, the need to work across devices pushes systems towards exportable representations, which increases risk. Better designs use the biometric to unlock a private key stored on the device; the account sees a cryptographic signature, not your biometric.

Combining biometrics safely

Used well, biometrics speed up routine unlocks without weakening core security. The safest pattern has two tiers:

• Device tier: the biometric unlocks the device locally, inside secure hardware, and never leaves it.
• Account tier: the device proves your identity to online services with cryptography (for example, passkeys, FIDO2/WebAuthn). The biometric controls access to the private key but is not itself the credential.

On phones and laptops, enable biometric unlock but keep a strong PIN or passphrase as the primary secret. Require that secret:

• after a restart;
• after a set number of hours;
• after multiple failed biometric attempts.

For banking apps, favour designs that pair biometric unlock with per-transaction checks such as strong customer authentication, challenge phrases or out-of-band confirmations. Avoid enrolling your biometrics with third-party services unless they clearly state matching happens only on your device and templates are not stored server-side.

Multi-factor does not mean piling on biometrics. Combine different categories:

• something you know (PIN);
• something you have (device or hardware key);
• optionally, something you are (biometric) as a convenience gate.

Where risk is higher (admin consoles, company VPNs, cloud dashboards), prefer hardware tokens or passkeys over server-stored biometrics.

Common misunderstandings

Myth: biometrics are "more secure" by default. Reality: they are different. They reduce friction and can prevent some shoulder-surfing, but their immutability creates unique failure modes.

Myth: templates cannot be reversed into usable forgeries. Reality: a leaked template can guide an attacker to build artefacts good enough for some sensors, especially where liveness checks are weak. Good systems limit this by never exporting templates and by revoking device trust rather than relying on biometric uniqueness.

Myth: face unlock works the same everywhere. Reality: indoors with stable light it may be excellent; outdoors at night it may fall back to a PIN. Reliability varies across people and conditions. Expect occasional failure and make your fallback secret second nature.

Practical, UK‑context examples

• Commuting on the Tube: you might unlock your phone dozens of times a day. Fingerprint or face unlock saves seconds without exposing bank logins, provided those logins use app-bound credentials like passkeys.
• At a border crossing: device search powers differ by jurisdiction and circumstance. Switching off biometrics and relying on a memorised PIN reduces the chance of compelled unlocking.
• At a protest: enabling the panic disable gesture and shortening the inactivity timeout are sensible trade-offs.
• In shared households: do not enrol other people's biometrics for accounts; use family sharing features that keep identities separate.

Operational practices

• Keep a strong PIN or passphrase you can remember under stress. Treat it as the actual secret.
• Enable biometric unlock only where the template stays inside secure hardware and cannot be exported.
• Use passkeys or hardware tokens for important accounts: let biometrics unlock the device, not authenticate to the service.
• Configure panic gestures to disable biometrics when needed, then learn and practise them.
• Set fallbacks: require the PIN after restart, after long inactivity and after several failed biometric attempts.
• Disable biometrics temporarily when coercion risk is elevated.
• Keep offline recovery options so that turning biometrics off does not block account access.