HACKING PROJECT · crypto · Advanced
Authentication & Secure Biometrics
Engineer a phishing-resistant, privacy-preserving biometric MFA system with liveness detection and revocable template protection, validated against presentation attacks.
Biometric authentication (face, fingerprint, voice, behavioral) is rapidly replacing passwords, but biometrics are non-revocable secrets: once a template is leaked or a presentation attack succeeds, the credential cannot be reissued. Systems frequently store raw or weakly protected templates, lack liveness/anti-spoofing, and are increasingly targeted by deepfake and synthetic-media presentation attacks. Weak binding between the biometric factor and the session/device also enables replay and man-in-the-middle capture.
**What you'll build**
Build a privacy-preserving multi-factor authentication system that combines a phishing-resistant FIDO2/WebAuthn passkey flow with a biometric factor secured by liveness detection (PAD), template protection (cancelable biometrics / fuzzy vault or homomorphic matching), and on-device matching so raw biometrics never leave the enclave. Red-team it with presentation and deepfake injection attacks, then measure False Accept/Reject and Attack Presentation Classification Error Rates against ISO/IEC 30107 methodology. Deliver a reference authentication service demonstrating unlinkable, revocable, spoof-resistant biometric MFA.
**Objective** — Engineer a phishing-resistant, privacy-preserving biometric MFA system with liveness detection and revocable template protection, validated against presentation attacks.
**Expected outcome** — A working WebAuthn + protected-biometric authentication prototype with a presentation-attack test harness and an ISO 30107-aligned PAD/error-rate evaluation report.
**Difficulty** — Expert — spans applied cryptography, biometrics, ML anti-spoofing, and secure system design.
**Primary category** — IAM / Authentication; Secondary = Applied Cryptography, AI/ML Security, AppSec
**Security domains** — Primary = Security Research; Secondary = AI Security, Blue Team, AppSec, GRC, Red Team
**Technical focus** — FIDO2/WebAuthn/passkeys, biometric template protection, cancelable biometrics, liveness/presentation-attack detection, deepfake/anti-spoofing, homomorphic/secure matching, MFA design, secure enclave usage, privacy-preserving authentication, replay resistance
**Core technologies** — Languages: Python, JavaScript/TypeScript, Rust/C for enclave; Frameworks/Libraries: WebAuthn libs (SimpleWebAuthn), OpenCV, dlib, PyTorch/TensorFlow, face/voice PAD models, TenSEAL/OpenFHE; Security Tools: presentation-attack toolkits, Burp Suite, deepfake generators for testing; Cloud/Infra: Docker, TPM/secure enclave, HSM/KMS; AI/Data: CNNs for liveness, anti-spoofing datasets; Databases: PostgreSQL, encrypted template store
**Where it's valued** — Banking/fintech, mobile, healthcare, government/border control, consumer identity, IAM vendors
**Careers it builds toward** — IAM Engineer, Biometric Security Researcher, Authentication Engineer, Applied Cryptographer, AI Security Engineer, Product Security Engineer
**Framework alignment**
• MITRE ATT&CK: Credential Access (TA0006); Steal Web Session Cookie (T1539); Adversary-in-the-Middle (T1557); Input Capture (T1056); Multi-Factor Authentication Interception. MITRE ATLAS: ML model evasion / spoofing of biometric classifiers relevant for deepfake PAD
• NIST CSF 2.0: Protect (primary), Identify, Detect; aligns to NIST 800-63B AAL2/AAL3
• OWASP: A07 Identification and Authentication Failures; API2 Broken Authentication; MASVS-AUTH
• CIS Controls v8: 5 (Account Management), 6 (Access Control Management), 16 (Application Software Security)
**Innovation** — Research-Level Project — combining revocable template protection, on-device matching, and deepfake-resistant liveness is at the research frontier with genuine IP potential. Scores: Innovation 9/10, Startup 8/10, Enterprise-Readiness 6/10, Patent = Possible.