Understanding Mobile Biometrics#
Mobile apps interact with biometric sensors via hardened hardware enclaves (Apple Secure Enclave, Android TEE). The application never sees raw biometric scans, receiving only cryptographically signed cryptographic assertions.
Everyday Analogy#
A trusted bank vault keeper: the guard inspects your photo ID, verifies your identity, and unlocks the safe deposit box without giving copies of your documents to strangers.
Architectural Best Practices#
- Encrypting persistent refresh tokens with hardware-backed keys
- Seamless fallback to device passcode on sensor failure
- Protection against physical brute-force attacks via rate limits