Risks of Using Biometric Authentication in Cybersecurity

By Zachary Amos •  Updated: 03/27/22 •  5 min read

Biometric authentication is one of today’s leading cybersecurity technologies, but it may not be as secure as it seems. While biometric authentication may be more difficult to hack, it does come with its own unique risks. These risks need to be addressed for biometric authentication to be truly secure. Users also need to be aware of the state of biometric authentication before scanning their face or fingerprint.

Protecting Biometric Data

Biometric authentication is in many ways more secure than passwords or PINs, especially when used as part of multi-factor authentication. However, it is important to remember that biometric authentication data has to be stored just like any text password. If alpha-numeric data can be stolen by cybercriminals, so can biometric data. The only difference is that biometric data is far more valuable.

Since biometric data is often used to secure high-value and sensitive data, more is at risk if biometric data is stolen. In fact, with facial recognition scans, fingerprints, and behavioral biometric data, a hacker could easily commit identity theft or tamper with biometric databases, such as those used to identify criminals.

So, while users may be getting a more secure login method with biometric authentication, they are putting more valuable information at risk if a network or server is compromised.

It is also important to remember that a stolen password can be replaced after the fact. Even if something as sensitive as financial information is compromised, users can still get new accounts and use more secure passwords and PINs in the future. However, if biometric authentication data is stolen, it is irreplaceable. It isn’t possible for users to simply get a new face or new fingerprints. Once biometric data is compromised, it is effectively permanent.

As a result, securing biometric data is more intensive than it may be for other types of data. There are solutions, though. For example, industry leaders have suggested things like authentication apps can store biometric data exclusively on local storage, such as that on a user’s smartphone, not on a large server. Before using biometric authentication, users need to carefully consider where the biometric scans will be stored and how that storage will be protected.

Deepfake Technology

Many modern smartphones feature facial recognition login options. This easy authentication method is quick and generally secure. After all, it would be extremely difficult to “hack” someone’s facial recognition scan. Unfortunately, emerging technologies are changing that.

Deepfake technology is making it possible to trick facial recognition systems using convincing photos or videos of someone’s face. Similar technology exists for making fraudulent fingerprint scans, as well. This may be more time-consuming than some other hacking methods, but cybercriminals can accomplish it if they want to get into a system badly enough. In fact, it is even possible to fake other types of biometric authentication, such as voiceprints.

In 2020, industry leaders used a deepfake algorithm to hack airport security facial recognition systems in a friendly hack to test biometric cybersecurity. The algorithm could trick facial recognition systems into mistaking one person’s face for another’s using image-swapping and morphing techniques. One researcher on the project even pointed out that there are many similarities between facial recognition algorithms, which could make it easier for hackers to create a successful deepfake algorithm.

Privacy and Legality

One unique risk that comes with biometric authentication is how biometric data is handled by companies, businesses, and websites. For example, if a biometric authentication company collects users’ facial and fingerprint scans and sells them to a local law enforcement agency, this may violate privacy laws. Biometric authentication data remains a murky area when it comes to legislation, though.

Since biometric authentication technology is still relatively new, federal legislation has not yet been established to regulate it. Concerns have been raised about what companies do with users’ biometric data, though. If biometric data is shared without a user’s knowledge, it could pose a risk of identity theft.

Additionally, it is difficult to know if a company is using biometric data to track a user’s daily activity and even harder for users to stop that tracking if they want to opt out. With internet advertising tracking, one can simply use a private browser or ad blocker. The same strategies don’t apply to biometric data.

This has led several local governments to put regulations in place to protect users from the risks associated with biometric authentication. California, for example, has a law guaranteeing citizens the right to “access, opt-out of the sale of, and delete” their facial recognition data from databases.

Several other states, such as Colorado and Illinois, have similar laws in place requiring companies to obtain users’ consent before handling their biometric data. Laws like these reduce the risks associated with biometric authentication.

Biometric Authentication Safety

Most of the time, biometric authentication is a highly secure login method for protecting personal information. Users do need to be careful about where and when they use it, though. Biometric data should be treated like one’s Social Security number, birth certificate, or other valuable personal data. Users can utilize biometric authentication safely by staying aware of who they are trusting their data with and the cybersecurity methods they have to protect it.

Zachary Amos

Zachary is a tech writer and the features editor of ReHack Magazine where he covers cybersecurity and all things technology.