I'm wondering since at least 2 offline password management services,Passkeep and Keepass both use biometric authentication in addition to the master password. You need to possess the physical device to login to those 2 services,but if the attacker already posseses the device how would biometric authentication protect the user from accessing the key and encrypted data or whatever sensitive data they might have?
0
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
Presumably the goal is not to "protect the user from accessing the key".
The intend seems to be protecting the user having stored valuable credentials in a device from impersonation by an attacker having stolen the device.
-
$\begingroup$ so it would make sense to you to have a offline password manager that requires both a master password and biometric authentication to access any personal data? $\endgroup$ Mar 16, 2022 at 14:23
-
$\begingroup$ Fir high-security application, that makes some sense. One needs device AND password AND biometric to use the credentials. Also, there might be a lower-security convenience mode where the device unlocks with password OR biometric device. Many mobile phones work that way. $\endgroup$– fgrieu ♦Mar 16, 2022 at 16:16