TechPrufer
Get started
Grab
Grab logoGrab · Feature trail

Biometric Authentication System

1 post · Jan 2022

What this trail covers

Grab has enhanced its identity and access management by implementing biometric authentication, leveraging device-specific secure enclaves and public/private key pairs. This system aims to strengthen security against social engineering and reduce costs associated with SMS OTPs. The implementation involves client-server trust establishment, secure key management within device enclaves, and a robust enrollment flow. Future plans include SDK integration and broader adoption across teams.

All Grab trails
  1. Biometric authentication - Why do we need it?This post details the technical implementation of biometric authentication, focusing on the use of device-specific secure enclaves and public/private key pairs for client-server trust establishment. It outlines the enrollment flow, including key generation, user authentication via biometrics, payload signing, and storing reference IDs. Key implementation details such as checking for rooted devices, using SHA512withECDSA, and storing data in encrypted shared preferences/keychain are also covered. The post highlights the impact of reducing user friction and SMS OTP costs, with an estimated 90% adoption and success rate.