Biometric authentication - Why do we need it?

Summary

Grab addressed the vulnerabilities and costs associated with SMS one-time passwords and PINs by implementing device-level biometric authentication. The architecture pairs device biometric sensors with hardware secure enclaves to protect private keys separately from the main operating system. During enrollment, Grab generates a public-private key pair using SHA512withECDSA, authenticates the user locally, and stores reference identifiers in encrypted device storage. HellfireSDK verifies that the device is not rooted, ensuring raw biometric data never leaves the handset. Early experimental runs indicate an adoption rate exceeding 90% and a login success rate near 90%.

Takeaways

1. 1

   Secure enclaves invalidate existing private key access whenever device security configurations change, such as adding another fingerprint or modifying a PIN.

2. 2

   The implementation verifies device integrity with HellfireSDK and stores reference identifiers in encrypted shared preferences or keychain while retaining all raw biometric data locally.

3. 3

   Early experiment runs demonstrated an estimated adoption rate exceeding 90% and a login success rate of nearly 90%.