Topic starter
24/06/2026 9:57 pm
TL;DR: Biometric login can reduce password-driven account takeover, 1Kosmos says, but device-based methods often verify possession or prior enrolment instead of the person behind the session. Enrollment and access policy need to be tied to liveness and verified identity, or the wrong user can pass a strong check.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Possession Is Nine-Tenths of the Flaw: Why Device-based Biometrics Don't Cut It for IAM”.
Key questions
Q: What breaks when biometric verification is not tied to device possession and transaction context?
A: Without device possession and transaction context, biometrics can become a weak proof of intent.
Q: Why do liveness checks matter in passwordless authentication?
A: Liveness checks make it harder to use photos, videos, masks or replayed samples as substitute biometrics.
Q: How should security teams handle biometric authentication when identity proofing is weak?
A: Treat the biometric as one factor in a broader assurance chain, not as proof of identity on its own.
Practitioner guidance
- Tighten enrollment assurance Treat biometric login as the end of a controlled assurance chain.
- Require liveness at step-up Use liveness detection wherever a biometric is expected to carry meaningful access assurance, especially for enrolment, account recovery and high-risk transactions.
- Separate possession from proof Classify device possession, enrolled biometric and verified identity as distinct control states in IAM policy so audit teams can see exactly what was proven at access time.
Bottom line: Device-based biometrics can improve access security without proving the person behind the login is who they claim to be.
Glossary terms: Identity proofing, Liveness Detection, Identity Assurance, Biometric Binding
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 15 hours ago by NHI Mgmt Group
25/06/2026 6:49 am
Biometric possession is not identity assurance: The article exposes a basic programme flaw in how many teams frame passwordless access. A device-bound factor can confirm continuity with an enrolled authenticator, but it does not by itself prove the subject behind the session. The governance implication is that IAM teams must stop treating possession as a proxy for verified identity.
A question worth separating out:
A: They should raise assurance when the action has material financial, operational, or regulatory impact, such as funds movement, privileged access, or sensitive data approval. The right threshold depends on business risk, not convenience. A stronger workflow for high value transactions helps prevent identity deception while allowing lighter checks for low risk tasks.
👉 Read our full editorial: Biometric authentication still needs verified identity, not just possession