Easing the password burden
Adams and Sasse (1999) showed complex password rules push users to write down or reuse passwords, weakening security. In Bhagavatula et al. (2015), users found fingerprint unlock fast and convenient, which also increased lock-screen use. Given tiny keyboards, biometrics greatly ease sign-in and payment approval.
When and how to offer it
Rather than asking at first launch, offer it right after a successful sign-in with a reason (Apple, n.d.), and note data stays on the device. De Luca et al. (2015) report face unlock in public feels like 'taking selfies', so let users choose fingerprint or face. This links to app onboarding.
Failure, fallbacks and security
Biometrics are probabilistic (Jain et al., 2004) and fail with wet fingers, masks or darkness, so show a PIN or password fallback after a few tries. NIST SP 800-63B (Grassi et al., 2017) treats biometrics as bound to a registered device. Fallbacks are essential for mobile accessibility, and WCAG 2.2 (W3C, 2023) 3.3.8 requires authentication not relying solely on memory. Failure messages should guide next steps per error prevention design.
FAQ
- Is biometric data sent to the app company?
- Typically it stays in the device's secure area; the app only receives success or failure.
- Is biometrics alone secure enough?
- It must be combined with device possession and backed by fallbacks.
Sources reviewed: 2026-10-27
References
- Jain, A. K., Ross, A., & Prabhakar, S. (2004). An introduction to biometric recognition. IEEE Transactions on Circuits and Systems for Video Technology, 14(1), 4–20. Introduction to biometric recognition and its error rates.
- Bhagavatula, C., Ur, B., Iacovino, K., Kywe, S. M., Cranor, L. F., & Savvides, M. (2015). Biometric authentication on iPhone and Android: Usability, perceptions, and influences on adoption. In Proceedings of the 2015 Workshop on Usable Security (USEC). Internet Society. Usability and perceptions of phone biometrics.
- De Luca, A., Hang, A., von Zezschwitz, E., & Hussmann, H. (2015). I feel like I'm taking selfies all day! Towards understanding biometric authentication on smartphones. In Proceedings of the 33rd Annual ACM Conference on Human Factors in Computing Systems (pp. 1411–1414). ACM. Reveals social awkwardness of face authentication.
- Adams, A., & Sasse, M. A. (1999). Users are not the enemy. Communications of the ACM, 42(12), 40–46. Classic on how password burdens undermine security.
- Grassi, P. A., Fenton, J. L., Newton, E. M., Perlner, R. A., Regenscheid, A. R., Burr, W. E., Richer, J. P., Lefkovitz, N. B., Danker, J. M., Choong, Y.-Y., Greene, K. K., & Theofanos, M. F. (2017). Digital identity guidelines: Authentication and lifecycle management (NIST Special Publication 800-63B). National Institute of Standards and Technology. Requires biometrics to be paired with a possessed device.
- World Wide Web Consortium. (2023). Web Content Accessibility Guidelines (WCAG) 2.2. Criterion 3.3.8 accessible authentication.
- Apple. (n.d.). Privacy. Human Interface Guidelines. Guidance on explaining permission and data use.