# Biometric authentication - Why do we need it?

[Grab](https://yomu.fyi/company/grab) · Chad Burgess · Jan 20, 2022

**Type:** Problem & solution

## Summary

Grab addressed the vulnerabilities and costs associated with SMS one-time passwords and PINs by implementing device-level biometric authentication. The architecture pairs device biometric sensors with hardware secure enclaves to protect private keys separately from the main operating system. During enrollment, Grab generates a public-private key pair using SHA512withECDSA, authenticates the user locally, and stores reference identifiers in encrypted device storage. HellfireSDK verifies that the device is not rooted, ensuring raw biometric data never leaves the handset. Early experimental runs indicate an adoption rate exceeding 90% and a login success rate near 90%.

## Context

Grab relied on PINs and SMS one-time passwords that were susceptible to social engineering, caused high user friction, posed fraud risks from shared driver accounts, and incurred SMS costs of $0.03 per message.

## Approach / What changed

Grab implemented client-server biometric authentication leveraging device biometric sensors, hardware secure enclaves, SHA512withECDSA key pairs, and HellfireSDK root detection to sign payloads locally without transmitting raw biometric data.

## Takeaways

- Secure enclaves invalidate existing private key access whenever device security configurations change, such as adding another fingerprint or modifying a PIN.
- The implementation verifies device integrity with HellfireSDK and stores reference identifiers in encrypted shared preferences or keychain while retaining all raw biometric data locally.
- Early experiment runs demonstrated an estimated adoption rate exceeding 90% and a login success rate of nearly 90%.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Authentication](https://yomu.fyi/topic/authentication), [Privacy](https://yomu.fyi/topic/privacy)

[Read original post](https://engineering.grab.com/biometrics-authentication)