I'm wondering since at least 2 offline password management services,Passkeep and Keepass both use biometric authentication in addition to the master password. You need to possess the physical device to login to those 2 services,but if the attacker already posseses the device how would biometric authentication protect the user from accessing the key and encrypted data or whatever sensitive data they might have?




1 Answer 1


Presumably the goal is not to "protect the user from accessing the key".

The intend seems to be protecting the user having stored valuable credentials in a device from impersonation by an attacker having stolen the device.

  • $\begingroup$ so it would make sense to you to have a offline password manager that requires both a master password and biometric authentication to access any personal data? $\endgroup$ Commented Mar 16, 2022 at 14:23
  • $\begingroup$ Fir high-security application, that makes some sense. One needs device AND password AND biometric to use the credentials. Also, there might be a lower-security convenience mode where the device unlocks with password OR biometric device. Many mobile phones work that way. $\endgroup$
    – fgrieu
    Commented Mar 16, 2022 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.