Biometrics

Biometrics means recognizing a person by something they physically are or do: a fingerprint, the shape of a face, the pattern of an iris, a voice, even the way someone types. It is what happens when you unlock a phone with your thumb or your face, cross an airport gate that checks your passport photo, or clock in at work by touching a reader.

The device does not keep a photo of your finger. When you enroll, it measures distinctive features (where the ridges of a fingerprint split and end, the distances between points of a face) and stores them as a compact template. Each time you unlock, it measures again and compares. Bodies and cameras are never exactly the same twice, so the answer is a matter of probability: the system is tuned to balance letting the wrong person in against rejecting the right one.

Its big advantage is convenience: you cannot forget your face, and nobody can read it over your shoulder. Its big weakness is that you cannot change it. A leaked password can be replaced in a minute; a leaked fingerprint template cannot. That is why well-designed phones and laptops keep the template in a protected chip on the device itself and never send it to a server, and why biometrics usually unlock a key or a passkey stored locally rather than acting as a password sent over the internet.

Biometrics also raise questions beyond security. Faces can be captured from a distance without consent, so facial recognition in public spaces, workplaces or schools is regulated in many countries and debated in others. For your own devices, the sensible view is that biometrics are a convenient lock that works best together with a PIN or password as backup.