Second factors and biometrics: a factor changes which attack fails

A second factor is usually described as more security. The claim argued here is narrower. A factor does not raise security in general; it redirects an attacker from one weakness to another. Whether the redirection earns its cost depends on two measurements. The first is which attack the factor is aimed at. The second is what error rate the people who must use it can bear. The two units that follow move from the mechanism to the adversary.

A factor ends in a threshold decision

Every authentication decision resolves to a comparison against a threshold that trades one error against another. The design question is not how strong the factor is. It is which error the deployment can least afford. Jain and colleagues (2016), surveying fifty years of biometrics, report that current systems recognise people accurately under controlled conditions from cooperative users. The unsolved problems lie where that cooperation is absent, including uncooperative subjects and the distinctiveness and persistence of traits. They conclude that a multi-factor combination may be the better route.

The same survey gives the threshold a number. In the NIST Fingerprint Vendor Technology Evaluation of 2003, the best commercial fingerprint matcher reached a true acceptance rate of 99.4 per cent at a false acceptance rate of 0.01 per cent. Accuracy falls sharply once a latent print from a crime scene or a face in a crowd replaces a finger on a scanner. The error rate belongs to a threshold and an acquisition condition, not to the trait.

A trait is an identifier, not a secret

The concession is forced by what a biometric is. A password can be kept and changed. A face or a fingerprint is on show and cannot be revoked. Matsumoto and colleagues (2002) cast artificial fingers from cheap gelatin, using moulds taken from live fingers or prints on glass. They report that these gummy fingers were accepted at extremely high rates by eleven commercial fingerprint devices. Jain and colleagues (2016) add that biometric data can link a person across applications in a way a password cannot.

Uniqueness is an estimate resting on assumptions

If a trait is an identifier, its value rests on the claim that it is unique. That claim is an estimate rather than a fact. Pankanti, Prabhakar and Jain (2002) derive an expression for the probability of a false correspondence between minutiae representations from two different fingers. They find that matching is not infallible and produces false associations, and that the evidence degrades drastically as noise enters the sensed image.

The paper takes twelve matching minutiae as the long-standing guideline for treating two prints as a match. It computes that a print with 36 minutiae shares 12 of them with another of the same size by chance with probability about 6 in 100 million. The automatic matchers of the day fell well short of the information the model says the prints hold.

A second factor changes what the attacker has to steal

M'Raihi and colleagues (2011) specify the time-based one-time password, which derives a short-lived code from a shared secret and the current time, so a code cannot be replayed after its window closes. The effect is not that guessing becomes impossible. It is that the password alone becomes insufficient: the attacker must obtain the shared secret or the device that computes the code. The design has changed which asset the attacker must reach rather than removed the route, and the honest question is whether that asset is better protected.

The friction is measured, and it does not track preference

Reese and colleagues (2019) ran a two-week, between-subjects study of five second-factor methods with seventy-two participants logging into a simulated bank, plus a setup study with thirty. The security key was fastest, with a median second-factor time of 9.1 seconds against 17.2 seconds for printed backup codes. Speed did not decide preference, though. The highest usability score after passwords alone went to the time-based code generator.

Doerfler and colleagues (2019) quantify the friction at scale, evaluating fourteen login challenges against more than 350,000 real hijacking attempts. Device-based challenges blocked over 94 per cent of phishing-rooted attempts and 100 per cent of automated attempts. Knowledge-based challenges prevented as few as 10 per cent of the phishing attempts. The same study measured the other side. Friction led 52 per cent of legitimate users to fail to sign in, though 97 per cent gained access shortly afterwards.

The error rate is not uniform across people

Where the factor is a biometric, the threshold decides who is admitted, and the error is not spread evenly. Buolamwini and Gebru (2018) evaluated three commercial gender-classification systems on a dataset balanced by gender and skin type. They found that darker-skinned women were the most misclassified group, with error rates up to 34.7 per cent, while the maximum for lighter-skinned men was 0.8 per cent. The two public datasets they examined were 79.6 and 86.2 per cent lighter-skinned, so the disparity had been invisible to the evaluation that certified the systems.

Grother, Ngan and Hanaoka (2019) confirm the pattern widely, testing 189 algorithms from 99 developers against 18.27 million images of 8.49 million people. False-positive differentials are the main effect, with rates across demographics often varying by one or two orders of magnitude. The demographic groups the report measures include age: it found elevated false positives in the elderly and in children, largest at the extremes. False-negative differentials are usually much smaller. A single error rate for a face system is an average over a population, and it can hide a factor-of-a-hundred difference between the groups inside it.

Contested question: is the error-rate gap the trait, the sensor or the model?

The literature agrees that face-recognition error rates differ between demographic groups. It disagrees about why. The answer decides whether the gap is a fact about people or a fault in a pipeline that can be repaired.

One position holds that the disparity is substantially an artefact of acquisition and of attributes that travel with demographic labels. Terhorst and colleagues (2022) analysed the influence of forty-seven facial attributes on two face models using a database of over 120 million attribute annotations. They found that many non-demographic attributes strongly affect performance, among them accessories, hairstyles and colours, face shapes and facial anomalies. They introduce control-group-based validity values that test whether the difference could be caused by the sampling.

A second position locates the cause inside the model's processing. Fu and Damer (2022) build explainability tools from face-model activation maps. They report that the models react differently in certain facial regions for some groups than for others, which points to the features the network relies on rather than to acquisition alone.

A third position treats the gap as a settled harm and shows that mitigation is possible. Kotwal and Marcel (2024) place an image-to-image fairness transformer ahead of a frozen recognition network, and they report fairer models with reduced accuracy variation. Grother and colleagues (2019) add a caution bearing on all three positions. The differentials exist across many but not all algorithms, so an operator must measure the specific algorithm on the specific data.

The evidence that would settle the dispute is a controlled benchmark. It would vary algorithm and acquisition conditions independently within one population, reporting per-group false-positive and false-negative rates together with the covariates the threshold depends on. No study in this unit isolates all three factors at once, which is why the disagreement survives.

The positions rest on different kinds of evidence. The trait-and-sensor position rests on a large study of attributes beyond demographics (Terhorst et al., 2022). The model position rests on an analysis of activation maps (Fu and Damer, 2022). The mitigation position rests on a transformer tested against frozen networks (Kotwal and Marcel, 2024), and the vendor test measures many algorithms but not all factors at once (Grother et al., 2019). While the dispute is open, the designer measures per-group error rates on their own algorithm and their own population. The strongest objection is that this unit's thesis, that a factor redirects an attacker rather than raising security, is argued from mechanism, and no study here measures takeover rates with and without the second factor on one population.

Where the argument is heading

The direction of travel is towards the pipeline and away from the trait. Fu and Damer (2022) and Kotwal and Marcel (2024) treat the error-rate gap as something to be explained and then reduced in the model. Grother and colleagues (2019) have turned that into an obligation: measure your own algorithm on your own data. The friction, meanwhile, is measured where it falls. Holtgrave and colleagues (2025) surveyed 108 public-sector employees and ran an in-situ experiment in which eleven experienced passwordless FIDO2 authentication. They found that only a minority were aware of current passwordless methods and that organisational obstacles held deployment back.

The sources this unit rests on

• Jain, A. K., Nandakumar, K. and Ross, A. (2016). 50 years of biometric research. Pattern Recognition Letters. doi:10.1016/j.patrec.2015.12.013 Surveys fifty years of biometric recognition, reporting accurate recognition under controlled conditions from cooperative users while leaving unconstrained conditions, uncooperative subjects, and the distinctiveness and persistence of traits unsolved. It concludes that a multi-factor combination with a password or token may be the better route.
• Matsumoto, T., Matsumoto, H., Yamada, K. and Hoshino, S. (2002). Impact of artificial "gummy" fingers on fingerprint systems. SPIE Proceedings. doi:10.1117/12.462719 Cast artificial fingers from cheap gelatin using moulds taken from live fingers or prints on glass. Reports that the gummy fingers were accepted at extremely high rates by eleven commercial fingerprint devices. It shows a trait is a public identifier rather than a secret that can be held.
• Pankanti, S., Prabhakar, S. and Jain, A. K. (2002). On the individuality of fingerprints. IEEE Transactions on Pattern Analysis and Machine Intelligence. doi:10.1109/tpami.2002.1023799 Derives an expression for the probability of a false correspondence between minutiae from two different fingers. Finds matching is not infallible, that the evidence degrades drastically with noise, and that the best automatic matchers fall short of the theoretical limit. It makes uniqueness an estimate resting on assumptions.
• M'Raihi, D., Machani, S., Pei, M. and Rydell, J. (2011). TOTP: time-based one-time password algorithm. RFC 6238. doi:10.17487/rfc6238 Specifies a one-time password derived from a shared secret and the current time, so a code is usable only within a short window and cannot be replayed later. It is the mechanism behind the most widely deployed second factor, and the reason the attacker must reach the shared secret or the device.
• Reese, K., Smith, T., Dutson, J., Armknecht, J., Cameron, J. and Seamons, K. (2019). A usability study of five two-factor authentication methods. Symposium on Usable Privacy and Security. https://www.usenix.org/conference/soups2019/presentation/reese Runs a two-week, between-subjects study of five methods with 72 participants logging into a simulated bank, plus a setup study with 30. Reports the security key had the fastest median second-factor time, 9.1 seconds against 17.2 seconds for printed codes, but that the highest usability score after passwords went to the time-based code generator.
• Doerfler, P., Thomas, K., Marincenko, M., Ranieri, J., Jiang, Y., Moscicki, A. and McCoy, D. (2019). Evaluating login challenges as a defence against account takeover. The World Wide Web Conference. doi:10.1145/3308558.3313481 Evaluates fourteen login challenges against more than 350,000 real hijacking attempts. Finds device-based challenges blocked over 94 per cent of phishing-rooted attempts and 100 per cent of automated attempts, while knowledge-based challenges prevented as few as 10 per cent of the phishing attempts, and that friction led 52 per cent of legitimate users to fail to sign in.
• Buolamwini, J. and Gebru, T. (2018). Gender shades: intersectional accuracy disparities in commercial gender classification. Proceedings of Machine Learning Research 81. https://proceedings.mlr.press/v81/buolamwini18a.html Evaluates three commercial gender-classification systems on a dataset balanced by gender and skin type. Finds darker-skinned women were the most misclassified group, with error rates up to 34.7 per cent against 0.8 per cent for lighter-skinned men, and that the benchmarks examined were 79.6 and 86.2 per cent lighter-skinned.
• Grother, P., Ngan, M. and Hanaoka, K. (2019). Face recognition vendor test part 3: demographic effects. NIST Interagency Report 8280. doi:10.6028/NIST.IR.8280 Measures 189 algorithms from 99 developers against 18.27 million images of 8.49 million people. Reports false-positive rates varying across demographics by one or two orders of magnitude while false-negative differentials are usually much less than a factor of three, and reports elevated false positives in the elderly and in children, with the highest false positives in West and East African and East Asian people.
• Terhorst, P., Kolf, J. N., Huber, M., Kirchbuchner, F., Damer, N., Moreno, A. M., Fierrez, J. and Kuijper, A. (2022). A comprehensive study on face recognition biases beyond demographics. IEEE Transactions on Technology and Society. doi:10.1109/tts.2021.3111823 Analyses the influence of forty-seven facial attributes on two face models using a database of over 120 million attribute annotations. Finds many non-demographic attributes, including accessories, hairstyles and colours, face shapes and facial anomalies, strongly affect verification performance, and introduces control-group-based validity values for unbalanced test data.
• Fu, B. and Damer, N. (2022). Towards explaining demographic bias through the eyes of face recognition models. IEEE International Joint Conference on Biometrics. doi:10.1109/ijcb54206.2022.10007962 Builds explainability tools from face-model activation maps to compare behaviour across demographic groups. Reports the models react differently in certain facial regions for some groups than for others, locating part of the disparity in the learned representation. It supplies the model-side position in the unit's dispute.
• Kotwal, K. and Marcel, S. (2024). Demographic fairness transformer for bias mitigation in face recognition. IEEE International Joint Conference on Biometrics. doi:10.1109/ijcb62174.2024.10744457 Places an image-to-image fairness transformer ahead of a frozen recognition network to enhance the representation selectively. Reports fairer models with reduced accuracy variation and often slightly improved average accuracy, and argues bias can arise in acquisition even from balanced training data.
• Holtgrave, J. U., Klivan, S., Marky, K. and Fahl, S. (2025). A qualitative study of adoption barriers and challenges for passwordless authentication in German public administrations. Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems. doi:10.1145/3706598.3713252 Runs a mixed-methods study with a survey of 108 public-sector employees and an in-situ experiment in which eleven experienced FIDO2 passwordless authentication. Finds only a minority were aware of current passwordless methods and that organisational obstacles held deployment back as much as the technology.