DEV Community

Discussion on: Universal passwordless authentication - The beginning

Collapse
 
dagnelies profile image
Arnaud Dagnelies • Edited

The fingerprint / face is used to access a protected (cryptographic) key stored on the device. In other words, as an attacker, you would first need to get your hands on the phone/laptop/other of the person you are trying to impersonate. ... And if you are able to fool the local authentication, you basically have all the rights on the device anyway.