Google rolls out new biometric authentication API for Android P

As a result, the company’s developers can start using the BiometricPrompt API to integrate biometric authentication into their apps. With Android P, Google aims to provide a better model for measuring biometric security, constraint weaker authentication methods, and provide a common platform and entry point for developers to easily integrate the capability, according to software Development Times.

Biometrics typically uses two metrics: False Accept Rate (FAR) and False Reject Rate (FRR). While both metrics provide accuracy and precision due to machine learning, the tech company believes they don’t account for an active attacker or provide information about its resilience against attacks. However, in Android 8.1, Google introduced Spoof Accept Rate (SAR) and Imposter Accept Rate (IAR) to measure how easily an attack bypasses a biometric authentication service.

SAR and IAR are used to detect whether biometric authentication mechanisms are strong or weak. Some examples of weak biometrics include having to re-enter a PIN or password, inability to authenticate payments or transactions, and shows users a warning about the risks of the biometrics.

Google hopes the new API will help strengthen and simplify digital identity authentication as well as providing the ability to securely and accurately implement biometrics.