The Guardian and Forbes reported that researchers traced a massive leakage of 28 Million biometric and personal records to a company whose products are used worldwide for physical access control to a UK based company. The leak included centrally stored fingerprint, facial recognition, photos, unencrypted usernames and passwords, logs of facility access, security levels and clearance and personal details of staff and comprised over 23 gigabytes of data. The breach reinforces the problem with server-side biometrics and adds to a series of such prior breaches such as the OPM data breach that leaked the biometrics and personal information of US Govt. employees.

This leak points to an “anti-pattern” that security professionals and corporations should understand clearly. A pattern is an idea of how to solve a problem within a class of problems, that repeats itself. An anti-pattern is an idea of how not to solve it because implementing that idea would result in bad design.

The old proverb goes, “Why did Willie Sutton rob banks?….because the money was there!” Biometrics that are transported and aggregated centrally on the server for storage and matching are the worst kind of anti-pattern. They create stores of secrets on the server-side that are attractive for hackers to breach. The possibility of a scalable attack is large, the economic returns are very attractive, and remediation is very complicated.

By contrast, biometrics that work only on your personal device and are never shared, stored or matched on the server are an effective and secure pattern. By distributing the sensitive information and protecting it with extraordinary security, there is no central repository to attack. In other words, Willie Sutton would be out of business as a bank robber and instead be reduced to trying to pick pockets – not a scalable endeavor.

Apple, Samsung and others have proven that by distributing and localizing biometrics to a personal device that is in your control and by placing extraordinary controls around the biometric capture and matching, you can use biometrics as an effective secure pattern. In this case, the data is distributed, and you can at best try a targeted attack on individuals, one at a time – even that is so difficult that the economic incentives are not attractive.

Nok Nok Labs believes deeply in the idea that for privacy, security and the prevention of catastrophic failures like the breach above, corporations should only use the client-side-only biometric pattern as implemented by reputable vendors. We believe this so deeply that we incorporated this as a basic design principle in the creation of the FIDO protocols at the FIDO Alliance that we founded in 2013. The protocols created a more resilient distributed security pattern and are backed today by industry leaders such as Google, Microsoft, Intel, ARM, Samsung, Lenovo, VISA, MasterCard and others who have joined the alliance.

The FIDO protocols represent a good pattern to solve the problem of server-side secret aggregation. Users can leverage a method of authentication that is natural and convenient such as the client-side-store-and-match biometrics on a personal device including a phone or a physical token such as a USB or Bluetooth dongle. The standard ensures that there are no aggregations of secrets (as would be the case with passwords) and is designed to mitigate scalable attacks of all kinds such as phishing, interception by Man-in-the-Middle or compromises of a central repository of passwords. Developers get a simplified interface to implement this, and operators can rely on a single backend infrastructure regardless of device, method of authentication or security requirements. In other words, the standard ensures simplicity for the user, developer and operator.

It’s a well-kept secret that FIDO is already deployed widely and used daily by nearly a billion users at major brands such as Intuit, Bank of America, T-Mobile, Cigna, Google and Microsoft in the US and across Asia at DOCOMO, Softbank, Yahoo! Japan, and some of the largest banks in the region. It is expected to be deployed by most forward-thinking brands by 2020.

Each of these interactions, thanks to biometrics, can be accomplished seamlessly and without friction. Switching from a casual inquiry, to a personal, non-sensitive account, to a private, highly-secured account is accomplished with a swipe of a fingertip or by blinking into a camera. The advent and mass adoption of consumer-grade biometrics has drastically changed the expectations of the consumer. No longer are they required to create and remember a highly entropic code to use as a shared-secret, now they can simply look at a that sliver of glass and blink.

And this is only the first wave. As consumers are seeing multiple different modes of biometrics crop up on their iPhones and Samsung devices, older platforms are embracing the innovation as well – the W3C is working with the FIDO Alliance to integrate strong authentication – incorporating biometrics – into the standard web browser requirements, Microsoft’s Modern Keyboard will have a fingerprint sensor hidden in a normal looking key. The way in which we interact with our smartphones is becoming the way in which we interact with all computing devices.

This allows us to explore a new way of thinking about consumer-grade security. Rather than one large, all access door – we can introduce a multi-gate system where access to information or functionality at a lower level can be a simple fingerprint swipe, but higher levels of access require additional levels of proof of identity. Historically, a single password was the only thing necessary to access and approve all levels of a transaction–from seeing a balance, to paying a regular bill, to transferring vast amounts funds. Now, a fingerprint can be used to view an account balance, but a consumer would need a fingerprint plus a facial recognition scan to pay a bill or a fingerprint, face and voice authentication to transfer funds. Even in combination – the friction to the user will still be less than typing in a complicated password on a tiny touch-screen.

It is not just those engaged in the biometric field that feel that way. There are significant indicators from both the public and private market that show biometric adoption is increasing. Government organizations are issuing statements like the recent cybersecurity Executive Order in the US, PSD2 in Europe which focuses on financial organizations, the National Cyber Security Strategy out of the United Kingdom – all make specific mention of how to handle biometrics and what biometrics are good for. In the private market, we are seeing adoption from almost every vertical – from Mobile Network Operators, to Payment Providers, to Financial Institutions, even companies focused on the Internet of Things are looking for ways to include biometrics.

But there is still work to be done. While we have policy makers in the government like the National Institute of Standards and Technology issuing guidelines to embrace biometrics and deprecate other less secure methods of authentication – department heads, like those at the Social Security Administration, still cling to their outdated models of passwords, one-time-passwords, email resets and SMS messaging. There are still advocates for server-side biometric storage that refuse to learn the lessons of the Office of Personnel Management breach in 2015. Financial Institutions – while claiming to be centers of innovation – seem to be in a never ending cycle of evaluating and piloting without ever deploying. During all this time of debate and delay, the malicious actors out there are becoming more savvy, more experienced and are developing more sophisticated means of breaching newly deployed technology.

At the end of the day, the State of Biometrics is mixed – it is both the best of times and the worst of times.