Biometrics authenticates you by what you are. A fingerprint, a face, an iris, a voiceprint, or the way you type. Unlike a password, you cannot forget it or write it on a sticky note. Unlike a token, you cannot leave it at home. That convenience is why fingerprint readers and face unlock are on nearly every phone. The same traits make biometrics attractive for high-security facilities and border control.

Biometrics are not perfect. A fingerprint can be lifted from a glass and replicated. Face recognition can be fooled by a photograph or a mask in some implementations. Voice can be recorded and synthesized. Liveness detection helps, requiring a blink, a movement, or a pulse. The bigger problem is permanence. You can change a compromised password. You cannot change your fingerprint. If a biometric database leaks, the damage is permanent. That is why most systems store a mathematical template rather than a raw image, and why biometrics usually works as one factor among several rather than the only check. Privacy concerns also matter. Some jurisdictions restrict biometric collection, and employees have pushed back on fingerprint time clocks. The technology works. The governance is still catching up.

Biometric modalities

• Fingerprint — cheap, accurate, widely deployed
• Facial recognition — convenient, works at a distance
• Iris scan — very accurate, requires cooperation
• Voice — useful for phone-based verification
• Behavioral — keystroke dynamics, gait, continuous checks

Biometrics is convenient and hard to share. That is exactly why it needs a fallback when it fails.