Biometric Authentication

Secure Document Access

Dropbox Business uses WebAuthn to control access to confidential files. When sharing sensitive documents (contracts, financial reports), admins can require biometric verification. Recipients must use fingerprint/Face ID each time they open the document - passwords alone aren't enough.

Administrative Actions

Cloud platforms like AWS and Azure require biometric re-authentication for critical operations (deleting production databases, modifying security groups). Even if you're already logged in, these high-risk actions trigger a biometric prompt to prevent accidental or malicious changes.

Time-Limited Access

Construction sites and hospitals use web-based visitor management systems that grant temporary biometric access. Contractors register their fingerprint upon arrival and can access authorized areas only during their scheduled hours, automatically revoking access afterward.

Regulated Content Access

Some European gambling websites use government-issued digital IDs with biometric binding. Users link their passport's biometric chip to their account during signup. Each login requires fingerprint verification that matches the passport chip, ensuring the actual ID holder is accessing the age-restricted service.

Alcohol & Tobacco Sales

Digital ID apps like CLEAR and Mobile ID let users verify their age for online alcohol purchases using biometric authentication. The app confirms via Face ID that the person making the purchase matches the ID on file, helping retailers comply with age verification laws.

Secure Password Recovery

iCloud Keychain uses biometric authentication to recover forgotten passwords. Instead of answering security questions (which can be guessed or researched), you prove your identity with Face ID. This makes account recovery both more secure and more convenient.

// Biometric-verified password reset
// Traditional: Answer security questions (hackable)
// Biometric: Verify with fingerprint/face
const resetCredential = await navigator.credentials.get({
  publicKey: {
    challenge: resetChallenge,
    userVerification: 'required'
  }
});

// Grant password reset access only if biometric matches

Lost Device Recovery

When you get a new iPhone and restore from backup, Apple uses your new device's Face ID to decrypt and restore your Keychain passwords. The biometric on your new device must match Apple's records before releasing your saved passwords - preventing thieves from accessing your accounts even if they steal your backup.

Automatic Session Extension

Banking apps like Chase use biometric re-authentication to extend sessions. After 5 minutes of inactivity, instead of forcing full re-login, the app asks for fingerprint verification to continue. This balances security (auto-timeout) with convenience (quick re-auth).

Sensitive Action Confirmation

Trading apps like Robinhood and E*TRADE require biometric confirmation for each stock trade. Even though you're logged in, selling $10,000 of stock requires a fingerprint scan. This prevents pocket-trades and gives you a moment to reconsider impulsive decisions.

Multi-Device Security

When you log into Netflix on a new device, existing devices get a notification: 'New login from Chrome on Windows.' You can approve or deny using Face ID on your phone. This lets you grant/revoke access to your account without sharing passwords.

SSH Key Authentication

GitHub and GitLab support FIDO2 security keys with biometrics for Git operations over SSH. Developers can push code to repositories by verifying with fingerprint instead of managing SSH key passphrases. This simplifies key management while improving security.

// Git push with biometric authentication
# Instead of: ssh-add ~/.ssh/id_rsa (enter passphrase)
# Use: Touch fingerprint sensor on security key

git push origin main
# Tap fingerprint → authenticated → push succeeds

Server & Infrastructure Access

AWS Session Manager and Google Cloud Console support WebAuthn for privileged access. Sysadmins must verify with biometrics before accessing production servers or modifying infrastructure. This creates an audit trail of who accessed what and when, with proof of identity.

API Key Management

Stripe Dashboard requires biometric re-authentication to view API secret keys. Even though you're logged in, displaying your live API keys (which can charge customers) requires fingerprint verification - preventing shoulder-surfing attacks and accidental exposure.