Biometric verification uses physical characteristics of a person to verify their identity. The fingerprint login or facial recognition you might use on your smartphone or computer are examples of biometrics. On Windows, you may know this feature as Windows Hello. On Mac, it’s called Touch ID.

Since biometrics are unique to you, they are generally believed to provide better security than passwords. Only your fingerprint or face unlocks your computer or phone. The information on this webpage is intended to explain what happens when you use biometrics, and enable you to make an informed decision about whether you wish to do so.

Safeguards for Your Biometrics

The biometrics used with Windows Hello and Touch ID never leave your laptop or device, and they are not stored in a form that would enable anyone to recreate your fingerprint or facial image. Cornell does not maintain or otherwise store biometric data centrally, or directly use it as an account credential. 

When you set up your fingerprint or face reader, the picture of your face, or the whorls of your fingerprints, get scrambled through a complex set of math formulas and turned into a unique string of letters and numbers. It is this string that gets stored on your device.

Even though this scrambled string will keep verifying your identity every time you unlock your device, it is not a copy of your fingerprint or face. Because of the careful complexity of the formulas that scrambled your information, no one can re-construct your fingerprint or your face.

For more information about how your information can and cannot be used at Cornell University, refer to University Policy 5.10, Information Security, University Policy 5.9, Access to Information Technology Data and Monitoring Network Transmissions, and the University Privacy website.

Biometric Options at Cornell

On Cornell-owned staff and faculty Windows or Mac devices, you have the option to use biometrics to log in to your device if your device offers it. Starting in spring 2024, faculty and staff will also have the option to use biometrics to log in to university applications and services through the Secure Connect service.

If you have concerns with using your biometrics in this manner, you have the option to log in by entering your password instead.

These details apply to Cornell-owned staff and faculty Windows or Mac devices. If your device uses a different operating system, you should review that vendor's policies to understand how they treat your private data.

Technical Details

When you set up Windows Hello, your information is stored in an encrypted database on your device. Apple stores your information in the Secure Enclave. For detailed information, refer to the vendor’s documentation.

The computational process that scrambles your fingerprint and turns it into a random string is called a “hash.” This introductory page is a good overview of the process, theory, and security behind hashing data and why your face or fingerprint can’t be reconstructed.

The string of letters and numbers representing your information is stored on your device, only -- it is not sent to Microsoft, Apple, or anywhere else, and it is used only for the purpose of user verification by Windows Hello or Touch ID. Applications interface with Windows Hello or Touch ID to verify your identity, but Windows Hello or Touch ID will only respond with a pass or fail for the authentication attempt.