May 2023 Summaries

In an engineer's guide to mobile biometrics, the evolution of biometric technology from its introduction in Apple's TouchID in 2013 to its widespread adoption in 80% of smartphones by 2022 is explored, emphasizing its role as a standard for mobile authentication. The guide is part of a series by Stytch, aimed at providing insights into the implementation of mobile biometric authentication, delving into security considerations, architectural patterns, and development nuances. It discusses the advantages of biometrics, such as ease of use and enhanced security, while addressing challenges like device-specific limitations, necessitating fallback methods like passkeys for seamless user experiences. The guide also explains how biometric data is stored locally on devices, ensuring security by avoiding data transfer over networks, and highlights the technical decisions involved in using public-key cryptography to bolster authentication processes. Stytch's approach to biometric authentication emphasizes using Ed25519 signatures for secure key management on iOS and Android, with considerations for local storage solutions tailored to each operating system. The guide concludes by underscoring the reliability and convenience of biometrics as an authentication method while encouraging the use of Stytch's mobile SDKs for streamlined implementation.

The second part of a three-part series by Stytch, authored by Spencer Lichtenberg, delves into the intricacies of mobile biometric authentication, focusing on event-based versus result-based architectures. Event-based biometric authentication is highlighted as less secure due to its reliance on boolean logic and the potential for spoofing or insecure local storage of sensitive data. In contrast, result-based biometrics employ hardware-backed APIs to protect cryptographic keys, offering enhanced security by requiring biometric authentication to access these keys. The application sandbox is crucial for storing credentials securely within the device, impacting the security effectiveness of these architectures. While event-based methods are easier to implement, result-based architectures provide a higher level of security and are recommended for applications handling sensitive data, aligning with higher standards like MASVS L2. Stytch's mobile SDKs aim to simplify the implementation of result-based biometrics, combining security with ease of integration, and the article sets the stage for further exploration of Android-specific biometric authentication challenges in the series’ next installment.

In a webinar hosted by Stytch, Reed McGinley-Stempel and Enzo Avigo discussed strategies for optimizing B2B onboarding flows to enhance user experience, conversion, and retention. They emphasized the importance of frictionless authentication processes, particularly in B2B contexts where security and organization-specific needs, such as single sign-on (SSO) and multi-factor authentication (MFA), are paramount. The conversation highlighted the value of using analytics to track and improve onboarding effectiveness by identifying key user actions and reducing friction. They also explored how strategic data tracking can enhance understanding of user behavior and improve onboarding flows. Auth flows aren't just technical necessities but can be leveraged as growth opportunities, as demonstrated by examples like Zapier, which improved conversion rates by refining its auth process. The discussion underscored the importance of balancing security and user experience, adapting to scale, and using data-driven insights to refine onboarding strategies continually.