A fallback path must not be weaker than the primary path

What it is

Biometric fallback assurance parity requires a non-biometric route used after no match, sensor unavailability, or user choice not to grant equivalent control more easily. If face unlock normally precedes a PIN but its failure screen reaches recovery through public facts alone, an attacker can deliberately cause biometric failure and choose the weaker branch.

Why it happens

Fallback is often added after the main flow for availability, yet it unlocks the same key, account, or sensitive action. If failure count, device state, and risk signals do not survive the transition, the alternative is treated as a fresh login rather than part of one attack surface. An attacker need not defeat the biometric model; obscuring a sensor, restarting a device, or invoking lockout may open a lower-assurance branch.

Studying it

Build the biometric authentication state machine and enumerate exits after cancellation, poor capture, repeated no-match, sensor fault, restart, and accessibility choice. Using test accounts, compare evidence, attempt limits, session lifetime, sensitive-action capability, and final privilege for every exit. Have authorized testers induce failures and test reliable downgrade. Judge by resulting control and attack cost, not whether both screens ask for “some verification.”

Where it stops holding

Parity does not require another biometric or identical interaction steps. Possession evidence, a longer local secret, rate limits, delay, notice, or temporary privilege reduction can combine into proportionate assurance. Emergency and accessibility routes must remain possible, with security achieved through different controls. This principle assesses branches after biometric failure; it does not replace an audit of every account-recovery route.

Applying it

• Mark where each biometric failure state goes, what evidence it requires, and which authority it grants in both design and implementation.
• Carry failed-attempt count and risk context into PIN, password, and recovery branches so switching methods does not reset the attack budget.
• Restrict transfers, credential changes, or key export during a lower-assurance fallback until supplemental verification restores privilege.
• Fault-test covered sensors, disconnected hardware, restart, and retry exhaustion, confirming that none opens an unmodeled shortcut.

Related

• Same group: O3.03.1 Probabilistic matching · O3.03.3 Unusable biometric characteristics
• Adjacent: O3.02.2 Recovery-path security floor · O3.06 Trusted path
• Search terms: biometric fallback security · authentication downgrade · fallback assurance