I've already posted this question on Stackoverflow, but got downvoted and told to post here instead. So here we go.

I am searching for citeable sources / papers that research about what is more secure in general: biometric authentication (something like touchID) in smartphones vs regular authentication (passwords, pincodes). I am looking for papers that actually come to a conclusion instead of answering the question with more questions. Surely this has to be measureable, since both are different types of authentication?

So far i googled on google scholar, but couldnt find any useful stuff. Any one else any idea?


Original post: https://stackoverflow.com/questions/42428372/scientific-research-about-what-is-more-secure-biometric-authentication-vs-regul

  • 1
    $\begingroup$ Your assumption "surely this has to be measurable, since both are different types of authentication"? is wrong. Authentication is a broad subject and it doesn't represent a slider from 0 to 10. Iris based authentication is very strong, but the liveliness detection may not be. So you'd be left wondering if it is secure in the specific setting, i.e. can somebody use a photo? Authentication is just a part of creating a secure system as well; you need to look at the system to define what is secure or not. $\endgroup$ – Maarten Bodewes Feb 26 '17 at 13:44
  • $\begingroup$ Maybe we should back a "scientific paper recommendations" site just like "software recommendations". Sit back and enjoy; let the flame wars begin }:) $\endgroup$ – Maarten Bodewes Feb 26 '17 at 13:48
  • 1
    $\begingroup$ … this has to be measureable, since both are different types of authentication? – Somewhat like apples and oranges can be measured since they are different. Just because they’re round, doesn’t mean they can be compared. In their core, they’re pretty different. $\endgroup$ – e-sushi Feb 26 '17 at 14:57
  • $\begingroup$ But let’s ignore those nit-picks and drop something constructive which might explain why you won’t find a paper concluding "X is more secure than Y" with absolute confidence – unless X or Y is broken or proven insecure. See, most of the time, you conclude something is unsafer than something else – which raises new questions which require further research… and every paper builds upon former papers, trying to dig towards the core of "potentially offering best security". This is an ongoing process, not something that ends with a conclusion "X is safe" but rather with the conclusion "Y is broken". $\endgroup$ – e-sushi Feb 26 '17 at 14:58
  • $\begingroup$ So, in the end you may be looking in the wrong corner. Look for papers that conclude one of the two is unsafe because of something, not for papers that conclude one of the two is safer. It’s like with cryptographic randomness: you can’t prove something is absolutely random, but you can prove that something is not random. Hope that helps. $\endgroup$ – e-sushi Feb 26 '17 at 15:03