Andrew-Riley

As a Product Manager for Identity Security, I’ve spent over a decade, including the last four years at Auth0, navigating the complex landscape of authentication and identity security. I specialize in building products that defend the 'front door' of the digital world, balancing robust protection with a seamless user experience. I believe that security should be an invisible enabler, not a hurdle, evolving constantly to meet new threats while keeping the human journey frictionless. When I’m not fighting bots and securing authentication flows, I spend my free time gaming.

Product Manager

Andrew Riley

Pooja-Bhojwani

Pooja is a Machine Learning Manager at Auth0 with 10 years of experience building and scaling intelligent systems. My background combines a strong foundation in software engineering with eight years of expertise in Data Science, allowing me to bridge the gap between complex research and production-grade machine learning systems. Throughout my career in fintech, e-commerce, and gaming, I have specialized in developing high-impact personalization strategies, robust risk mitigation frameworks, and scalable machine learning solutions. I am passionate about translating advanced machine learning into real-world applications that deliver measurable results while helping keep digital platforms safe and trustworthy.

Manager, Machine Learning

Pooja Bhojwani

Learn how Auth0 is using JA4 fingerprinting to defeat sophisticated bots, bypass TLS spoofing, and improve TLS security for your applications without code changes.

Strengthening Bot Detection with JA4 Signals

E017NDYFGQL-U4W9C40NL-51be4d627a6f-512

Ari is a seasoned Product-Led Growth (PLG) leader with a passion for architecting flawless customer journeys. As the VP of Developer-Led Growth at Auth0, he leads the Developer Marketing, Developer Relations, Activation, and Conversion teams, among others. His career journey includes a key role on the Microsoft Developer Evangelism team and a foundational period as a Software Engineer at Southworks and other firms, where he delivered mission-critical projects for Fortune 100 clients.

Vice President, DLG

Ari Schapiro

Explore Auth0's August 2025 product updates, featuring enhanced flexibility with passwordless connection switching and improved security through DPoP and TLS fingerprints.

August 2025 in Auth0: Non-Unique Emails, DPoP, and TLS Fingerprints

jamie-hughes

At Fingerprint, Jamie solves EMEA customers' device intelligence challenges at each stage of the digital lifecycle (from ATO to credential stuffing to MFA friction and more) by quickly discerning their technical needs and demonstrating how Fingerprint can help them stop fraud and grow revenue. Jamie was previously a lead sales engineer at Auth0 and Beyond Identity. His years of experience in both the CIAM and device intelligence space enable him to help customers seamlessly reduce fraud and improve the user experience by combining best of breed identity and security solutions.

Solutions Engineer at Fingerprint

Jamie Hughes

Changing the conversation from “detected” to “prevented”… stop identity fraud at the source.

**TL:DR:** Digital identities have emerged as a crucial aspect of an online existence. From buying a product online, logging into a streaming service, or communicating with friends via social media, digital identity is a fundamental component in each of these activities. At the same time, companies must ensure digital identities are safe from malicious actors without adding friction for trusted users. This blog outlines how device intelligence can play a crucial role in protecting digital identities from fraud and optimizing the user experience.

## The Role of Digital Identity

A digital identity encompasses the data and information that represents an individual, organization, or device online. It plays a pivotal role in how a person interacts, transacts, and takes advantage of the digital world.

Successful validation of a digital identity enables one to perform associated actions and transactions for the service being used, such as updating account information or authorizing a banking transaction. However, malicious actors target these digital identities to commit fraudulent transactions or steal valuable data, which has left many users lacking trust and confidence in the security of their online accounts.

## Types of Digital Identity Fraud

* New Account Fraud<br /> New account fraud (or fake accounts) occurs when users sign-up more than once to receive one-time bonuses or promotional offers as a reward for becoming an account holder but with an ulterior motive. 
* Account Takeover (ATO)<br /> Account takeover occurs when malicious actors steal login credentials to access someone else's account. Once fraudsters have access, these accounts can be used to conduct various activities, such as transferring funds or accessing personal data.
* Social Engineering<br />  Social engineering is a deceptive and manipulative technique used by cybercriminals to gain unauthorized access to sensitive information; instead of relying on technical vulnerabilities, social engineering preys on people's trust, curiosity, and willingness to help. It often takes the form of phishing emails, pretexting phone calls, or impersonation tactics, tricking individuals into divulging confidential data or performing actions that compromise security. In September 2022, Uber's private network was [breached by a teenage hacker](https://fingerprint.com/blog/why-social-engineering-attacks-are-successful-with-technical-staff/) who used social engineering methods to gain secure information from an engineer.

## What about Multi-Factor Authentication (MFA)?

Product teams are conscientious about adding additional layers of friction to secure user accounts, fearful that they will abandon the transaction or sign-up process, resulting in a loss of revenue. This typically means that MFA is not mandated and is optional for the user. Even when users opt-in or MFA is enforced, companies are still relying on weak or outdated MFA methods, such as SMS/email one-time password (OTP) or cookie-based MFA, which can easily be phished or spoofed.

Strong MFA is an effective defense layer to help secure user accounts, given how easy it is to steal a user's password. However, many companies are challenged with how to make accurate and context-based MFA decisions that reduce friction for genuine users. Most forms of context-based authentication rely on IP addresses or cookies, which on their own are not stable or reliable enough to ensure the trust required to skip the MFA stage.

As a result of the above challenges, most companies fall back to challenging all authentication transactions with MFA, resulting in unnecessary user friction and rising SMS OTP costs.

## How Device Intelligence Protects Accounts

Accurate device intelligence recognizes trusted users from bad actors. Generating an accurate and stable device identifier during account creation or the next trusted login results in the user having a list of “trusted devices”. If an authentication attempt is initiated from a “new” device not within that list, the attempt can be blocked or challenged with a strong MFA factor. When the actual user returns and authenticates from a “trusted device,” you have a high degree of confidence it is actually the owner of the account and can, therefore, skip any additional friction, which leads to an enhanced, seamless user experience.

Capturing device intelligence data for each account creation request allows you to make smart decisions on whether or not to allow account creation. During the creation process, if the device identifier captured already exists for a registered user, depending on your allowed account-to-device ratio, you can block or allow the sign-up request. 

Companies who are using device intelligence are able to block malicious actors from using their services by adding them to a block list, as they can easily identify when they have attempted to create multiple fake accounts (for the purpose of promo abuse or [SMS pumping](https://fingerprint.com/blog/sms-pumping-fraud/)) or attempted account takeover attacks using their device/browser or browser automation tools (bots).

## Why Fingerprint with Auth0

Fingerprint was built to help companies solve complex identity & fraud-based challenges. Fingerprint is an API-based solution, which makes it very easy to plug into Auth0’s well-known [Extensibility](https://www.okta.com/customer-identity/extensibility/). 

Using Fingerprint in addition to [Auth0 Security](https://www.okta.com/customer-identity/login-security/) modules layers in an extra level of defense to help keep your Auth0 tenant safe from synthetic account creation and account takeovers. This is achieved by adding Fingerprint’s unique device fingerprint to the Auth0 user profile for each user at signup or a trusted login. Fingerprint’s visitor identifier is 99.5% accurate at identifying returning visitors; it can then be used to evaluate the identity of the device that is attempting to authenticate. 

See the example flow below for preventing account takeovers: 

![Auth0 Security](https://images.ctfassets.net/23aumh6u8s0i/4P8cG3n0TfGZAAiQIn9yZn/150b48b1b176d0bd24b7e19ad06663a4/use-case.png)

In addition to device identification, Fingerprint also provides [Smart Signals](https://fingerprint.com/products/smart-signals/), such as bot detection, VPN detection, and browser tampering detection, that pinpoint indicators of fraud from anonymous traffic. All of these Smart Signals can be evaluated in Auth0’s extensible [Actions](https://www.okta.com/customer-identity/actions/) within the sign-up or login flows.  

You can find additional details and technical integration documentation in the Auth0 Marketplace [Fingerprint listing](https://marketplace.auth0.com/integrations/fingerprint-pro). 

## Conclusion

One of the key use cases for implementing a device intelligence platform is to prevent fraud, and as discussed above, digital identities are prime targets for types of fraud, such as signup abuse,  account takeover, and social engineering. 

Unique, stable, and accurate device identifiers from Fingerprint recognize good users from bad users and block the activity associated with bad actors as a result. Accurately identifying the devices of your good users and incorporating them with Auth0 Actions allows you to make smart decisions to keep accounts secure with no additional friction. 

To get started, sign up for your free Fingerprint trial [here](https://dashboard.fingerprint.com/signup) and check out the Auth0 Marketplace [Fingerprint listing](https://marketplace.auth0.com/integrations/fingerprint-pro) for more details on how these solutions work together to help you stop fraud without friction.

Leveraging Device Intelligence to Protect Digital Identities

william_johnson

  Will Johnson is a Developer Advocate at Auth0. He loves teaching topics in a digestible way to empower more developers. He writes blog posts, records screencasts, and writes eBooks to help developers. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>.


Developer Advocate

Will Johnson

Learn how to enable fingerprint authentication for login with Auth0.

Over the years, how you prove your identity and login to websites has changed. From using only a password, using a password plus a code sent your mobile device, using authenticator apps, to even going _passwordless_ by having an email sent to you and logging in there. Each iteration is an attempt to keep your identity safe and secure. 

WebAuthn was announced as the recommended standard for passwordless login in recent years. WebAuthn is a browser-based API that allows secure user authentication by using registered devices (phones, laptops, etc.) as authentication factors. This blog post will show you how fast you can enable device biometrics for your users to log in using the Auth0 dashboard.

## What You'll Need

To enable and test out fingerprint authentication, you will need a few things:

* **Auth0 Account.** Sign up for a <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">free Auth0 account</a> if you don't have one.
* **Any application that uses your Auth0 tenant to provide Universal Login.** Any web-based, mobile, or desktop application will do, just as long as it is one of your tenant's applications. If you don't have any applications that use Auth0 for authentication, you can download one from the [Auth0 Quickstarts](https://auth0.com/docs/quickstarts/) page.
* **WebAuthn Compatible Device** A computer or smartphone with biometrics built-in (Touch ID on Mac, for example).

## Enable Biometric Login Flow

On the left-side menu of the Auth0 dashboard, click **Authentication>Authentication Profile**. The _Authentication Profile_ page is where you choose how users will authenticate their identity when logging in to your application. 

![Auth0 Dashboard Side Menu](https://images.ctfassets.net/23aumh6u8s0i/646bZGVEd7cE2iyRioHonq/ac74ca497a3f913cecdeedc05f9a1abc/auth0_dashbord.png)

You'll have the option to choose between three different login flows:

* **Identifier + Password** - a single login screen that asks for the username and password.
* **Identifier + First** - has two screens. One for the users to enter an identifier, then another screen for the password.
* **Identifier First + Biometrics** - allows users to sign in using face or fingerprint recognition instead of a password.

Click **Identifier First + Biometrics** then click **Save**. This sets the login box to ask for an identifier first, like an email address, then ask for the biometrics identifier like a fingerprint. 

After a device is registered for authentication, this creates a secure relationship between the application and the device, allowing users to login in a secure manner. Click **Confirm** on to enable Webauthn device biometrics.

![WebAutn Device Biometrics Confirmation Modal](https://images.ctfassets.net/23aumh6u8s0i/54D7A7i1R4hSgrTsvu9MVK/cdfeb155c3eed9fad84be4cb7e73c0b7/webauthn_confirmation.png)

The following user who logs in or signs up will be prompted to enroll their device for quick and secure login. Let's test out this flow from the users' perspective.

> Learn more about WebAuthn and test out using hardware authentication with the interactive demo on [webauthn.me](https://webauthn.me/). A site maintained by Auth0.

## Test WebAuthn Enrollment

The fastest way to test this is right on the _Authentication Profile_ page. In the upper right-hand corner, click **Try**.

![Auth0 Dashboard Authentication Profile Page](https://images.ctfassets.net/23aumh6u8s0i/155RocmMWOUTnwRI6vYDqP/f5cde8f2a017d5a37b154538edf97f9a/try_button.png)

This will bring up the Auth0 universal login box. You'll log in with a username and password as normal. Once those credentials are verified, you'll be met with the "Login in faster on this device" prompt. Which lets you know that you use your fingerprint or face recognition to log in. Click **Continue**

![Auth0 Long In Faster Screen](https://images.ctfassets.net/23aumh6u8s0i/6nQuQcDC6aLDDJBGSvIieK/3180262b363896a99d371c0229cc28c4/Screen_Shot_2022-02-23_at_4.37.39_PM.png)

Clicking continue brings up a prompt from your device alerting you that your browser is trying to verify your identity. You then register your fingerprint using something like Touch ID if you're using a Mac.

![macOS Touch ID prompt](https://images.ctfassets.net/23aumh6u8s0i/45MRt2zzkxol16HSy8aNuy/9daf52c856f8d176182c90f719007ff4/Screen_Shot_2022-02-23_at_4.38.15_PM.png)

Finally, it will ask you to name your device; click **Continue** the next screen lets you know that the device is successfully registered. 

![Device Registered Confirmation Page](https://images.ctfassets.net/23aumh6u8s0i/6eEg5vwZoXM4ApVeHFhpMv/dfd5b6d077af23b74f1889f689c31d46/Screen_Shot_2022-02-24_at_11.51.43_AM.png)

Once a device is registered, the user will no longer log in with a password. They will enter their email address and log in with their fingerprint! How cool is that?

> Users can still log in with their password as a backup. 

## Benefits of WebAuthn

Using WebAuthn for passwordless login has many benefits. 

* Customers don't have to worry about remembering passwords or requesting passcodes to be sent to a separate device
* Removes barriers to customers to sign in/up for applications 
* Lower risks of impersonating identity because it's hard to steal a device where the biometrics are stored.
* Maintain customer trust by using a secure authentication method 

## Conclusion 

Moving towards more advanced authentication methods like WebAuthn is a great way to delight your users and build trust in your company. Keeping users safe from potential security exploits is a hard job. Data breaches are becoming common. Auth0 is staying up to date with web security standards and creating solutions that integrate seamlessly into your application. 

To learn more about WebAuthn and how to use it with Auth0, check out the [FIDO Authentication with WebAuthn Docs](https://auth0.com/docs/secure/multi-factor-authentication/fido-authentication-with-webauthn)

Enable Fingerprint Authentication with Auth0

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

How biometrics are facing the pandemic and the world after



Biometric authentication has long been a polarizing subject: some see it as the key to a frictionless and secure future, while others imagine a dystopian nightmare. The coronavirus pandemic has brought this conversation to the fore as governments and corporations explore how to use biometrics as a way to track disease, even amid fears that traditional forms of biometric authentication may be disease vectors.

Below, we’ll discuss the potential and the pitfalls of biometrics, as well as how they are likely to evolve once the pandemic has passed.

## Contact-Based Biometrics Suffer

Before the coronavirus, entering a building by pressing your fingerprint into a scanner seemed futuristic. But these days, the notion of hundreds of people touching the same scanner seems like it belongs to the pre-pandemic past.

This shift has rocked the biometric world, and a [recent report from ABI Research predicts](https://www.abiresearch.com/press/covid-19-pandemic-pummels-biometrics-market-causing-device-revenues-drop-us2-billion-while-forcing-investment-surge-ai-face-recognition-applications/) that the biometric device market will lose $2 billion in 2020 due to the pandemic. This loss is coming chiefly from contact-based biometrics used in public settings, like fingerprint and palm readers used to access buildings. The [NYPD has halted](https://findbiometrics.com/biometrics-news-nypd-hq-ceases-use-fingerprint-authentication-slow-coronavirus-031107/) its fingerprint security procedures for officers, [New York City municipal workers](https://nypost.com/2020/03/14/nyc-municipal-workers-dont-want-to-touch-hand-scanners-to-clock-in/) have pressured employers like the MTA to stop using fingerprint-scanning time clocks, and [_CSO Online_](https://www.csoonline.com/article/3535194/new-coronavirus-era-surveillance-and-biometric-systems-pose-logistical-privacy-problems.html) reports that condo associations are dropping their biometric building-entry procedures.

But this damage to contact-based biometrics is not universal. ABI Research has clarified that fingerprint sensors for personal devices like smartphones and laptops will feel less of an effect from coronavirus, since those scanners are typically used by only one person.

<include src="TweetQuote" quoteText="Would you still touch a fingerprint scanner? Sr. Director of Governance, Risk, and Compliance Adam Nunn on how the pandemic is re-shaping biometric authentication."/>

If you’re a business considering using contact-based biometrics as a form of authentication, deciding whether or not to move forward is all about context. If you want users to be able to use the fingerprint scanner on their smartphone for [multi-factor authentication](https://auth0.com/learn/multifactor-authentication-customers/), you may not need to change your plans. But any form of biometric authentication that requires multiple people to touch the same surface may be a public health concern in the post-pandemic world.

## Using Contactless Biometrics to Fight the Pandemic

Contactless biometrics such as facial recognition and touch-free fingerprint scanners have come into prominence because of their ability to identify virus carriers and assist in contact tracing.

Biometric digital IDs may have a role to play in administering the (hoped for) coronavirus vaccine, especially for people with no other form of identification. [According to the Center for Global Development Senior Fellow Prashant Yadav](https://www.biometricupdate.com/202004/biometrics-could-help-identify-those-with-antibodies-and-needing-vaccines-as-coronavirus-lockdowns-lift), “The initial COVID-19 vaccine supply will be limited, so it will be essential to verify each dose reaches a real patient. Corruption, leakage, and even accidental duplication waste precious supply and are deadly,” he said. “Biometric digital IDs can be a gamechanger,” he added. “They can help governments target population segments e.g. healthcare professionals or elderly populations, verify people who have received vaccination, and have a clear record.”

Facial recognition technologies are also undergoing a dramatic evolution during the pandemic, with [multiple companies](https://www.csoonline.com/article/3535194/new-coronavirus-era-surveillance-and-biometric-systems-pose-logistical-privacy-problems.html) touting software that can identify people even when they’re wearing masks. This could have major public-health benefits, such as the ability to quickly identify people and move them through security without packing them together in confined spaces, such as airports.

Even before the virus, China was in the midst of an aggressive rollout of [facial-recognition cameras](https://www.npr.org/2019/12/16/788597818/how-china-is-using-facial-recognition-technology) in public settings. China is now coupling that technology with infrared temperature scanning, allowing the government to identify and track individuals with COVID-19 symptoms. For instance, [public buses in Guangzhou](https://asia.nikkei.com/Business/China-tech/Coronavirus-gives-China-more-reason-to-employ-biometric-tech) are now being equipped with tablets that take passengers’ photos and temperatures, a step that is mandatory. Supporters of such measures argue that they have been instrumental in containing the spread of the virus.

## The Privacy Pitfalls of Biometrics

In a world still searching for ways to identify carriers of coronavirus and let healthy people get back to their lives, biometrics may be part of the solution. However, this type of data collection also raises a host of privacy concerns, including the troubling specter of biometrics being employed as a tool for authoritarian governments to quash dissent.

We’ve already seen the potential for data misuse during this pandemic, even without biometrics. In South Korea, the government has publicly shared updates on the activities of patients by using a combination of interviews, video surveillance, phone location tracking, and credit card transactions. The result has been a spate of online harassment, not just of suspected carriers but of people whose data caught them in a lie or an act of infidelity. [The BBC reports](https://www.bbc.com/news/world-asia-51733145) that in a survey of 1,000 South Koreans, researchers found that people were more afraid of the stigma associated with infection than of the virus itself.

Concerns over government overreach, unscrupulous corporations, or snooping neighbors mean that data collection efforts are likely to meet with resistance. A [poll by the Jean-Jaurès Foundation](https://www.telegraph.co.uk/news/2020/04/12/french-public-hostile-proposed-covid-19-contact-tracing-app/) found that over half of French people (53%) would refuse to download the proposed “StopCovid app” over privacy concerns.

## The Post-Pandemic Future of Biometrics

Without a doubt, the coronavirus has altered the balance between an individual’s right to privacy and the public’s right to safety. Now, governments and businesses must carefully consider what the “new normal” version of that balance will look like and what role biometric identification will play.

When it comes to government use of biometric data, it’s crucial to have a public dialogue about the level of surveillance citizens should tolerate once the crisis has passed. Toby Norman, CEO of Simprints, a UK-based biometric nonprofit, [addressed those concerns to Reuters](https://uk.reuters.com/article/health-coronavirus-tech/biometric-ids-can-be-gamechanger-in-coronavirus-antibody-tests-vaccine-idUKL8N2BV0BI): “National governments don’t have a very good record of giving up new powers once a crisis has passed. Technology we use for disease surveillance today should not become tools for state surveillance at a later date.”

In many countries, there are laws already on the books, which should act as safeguards against biometric abuse. For instance, many U.S. states, such as Illinois, have [biometric privacy regulation laws](http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57), which require consumers to consent to their biometric data being collected. This would rule out things like temperature scans on city streets but might still allow for voluntary participation in airport security.

<include src="TweetQuote" quoteText="What’s the post-pandemic future of biometric authentication? Sr. Director of Governance, Risk, and Compliance Adam Nunn takes a look at COVID-19’s current and potential impact."/>

In the EU, the [European Data Protection Board](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032020-processing-data-concerning-health-purpose_en) (EDPB) has issued guidelines for app developers for using health data to combat coronavirus without violating the GDPR. The guidelines state that “data and technology used to help fight COVID-19 should be used to empower, rather than to control, stigmatise, or repress individuals.”

For companies that are interested in using biometrics to keep their workplaces safe, it’s vital to acknowledge and address privacy concerns. Implement transparent policies regarding how you plan to use biometric data, who will be able to access it, and how long it will be kept.

## Balancing Collective Safety With Individual Rights

Like most technology, biometrics are only as good or as evil as how we choose to use them. For many people, the thought of paying for lunch by smiling into a facial-recognition screen suddenly seems much more comfortable than making physical contact with a card reader. Likewise, a temperature scanner that knows you’re running a fever before you do may have broad appeal in office buildings and public transportation. But most people would be uneasy with an app that records your vital signs without your consent and then texts the information to everyone on your block.

The difference between biometrics as a public health boon and as a privacy nightmare is evolving, and the only way to make sure we wind up on the right side of that line is through continuous conversation with experts and the public at large. At Auth0, we will continue to explore biometric authentication by adhering to our core principles of security and transparency. To discuss how these precepts can play into your biometric strategy, please [reach out to our team](https://auth0.com/contact-us?place=blog%20post&type=link&text=reach%20out%20to%20our%20team).

<include src="asides/AboutAuth0" />


Biometrics and Coronavirus: Balancing Promise With Privacy

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

Find out how Espruino's JavaScript engine works on top of the popular ESP8266 microcontroller.

"fingerprint"