Amazon Key's fingerprint update sounds like a security upgrade, but using biometrics as the first authentication factor actually opens up more vulnerabilities than it closes. Quality beats quantity when it comes to multi-factor authentication, and Amazon added a factor in the wrong order.

The Situation

When Amazon debuted Amazon Key, its in-home delivery app, in October 2017, it gave users the ability to watch activity in their home and grant remote access to their smart lock. The product immediately raised big questions: how will customers know when it's okay to unlock their door for a stranger? Does the convenience of fast, secure package delivery outweigh the privacy and security trade-offs? As TechCrunch put it, "given that the app essentially controls who gets in and out of your home, it would be problematic if your phone got into the hands of someone malicious."

Problematic is a generous way of putting it. Catastrophic is closer.

After public criticism, Amazon added fingerprint authentication to the Android version of the Key app in March 2018, with iOS support promised to follow. It's a reasonable instinct, add a layer of security, but it's also where Amazon got the order wrong.

The Problem With Biometrics as a First Factor

Using biometrics as the first authentication factor sounds great on paper, but it actually opens up more vulnerabilities than it closes. In practice, Amazon applied a Band-Aid to a structural security issue. Passwords and usernames are inconvenient and annoying, everyone knows that, but swapping them for a fingerprint as the first checkpoint doesn't fix the underlying design problem.

To actually protect consumers and their data, companies need to move the login process away from "something you know," human-readable credentials like passwords and PINs, toward "something you have," like a smartcard ID or a cryptographic USB key.

Why Order Matters

The fingerprint biometrics Amazon adopted are genuinely exciting technology. The harder question is how a company with millions of customers balances flexibility and convenience against real security. Biometrics make an excellent additional verification factor. Used as the first and only step in identification, they're a weak foundation to build on.

For that first step, authentication should always start with something the consumer has, followed by something only that consumer knows. It's also worth separating the methods used to unlock a device at all from the methods used to unlock its most sensitive features. If a consumer uses a PIN to unlock their phone generally, that same PIN shouldn't also be what unlocks something as consequential as remote entry to their home.

Amazon's Duty of Care

Amazon deserves some credit for taking a step toward protecting its customers after the backlash. But these are exactly the questions that should have been answered before Amazon Key reached the public, not patched in afterward. Protecting the people who trust you enough to let a stranger into their home while they're not there isn't a feature to add later. It's a duty of care Amazon owed its most loyal customers from day one.

What Companies Can Do Instead

Enterprises can move to secure, simple multi-factor authentication using WWPass and pair it with the biometric features already built into customers' phones. With the free WWPass Key mobile app, customers can safely use fingerprints or other biometrics as part of authentication, in the right order, while companies keep their business, and their customers' homes, genuinely secure. The same principle applies broadly: see Beyond 2FA: Passwordless Protection That Works for why starting with possession, not knowledge or biometrics alone, changes the security model entirely.

FAQ

Why is using a fingerprint as the first authentication factor a problem?
Because it skips the "something you have" step entirely. If someone gets physical access to an unlocked phone, or finds a way around the biometric check, there's no second layer standing between them and a sensitive action, like unlocking someone's front door.

What's the right order for authentication factors?
Start with something the person has (a device, a cryptographic key, a smartcard), then verify with something only they know or something they are, like a PIN or a biometric. Biometrics work well as a second checkpoint. They're weaker as the only checkpoint.

Should the PIN that unlocks a phone also unlock sensitive features like a smart lock?
No. Using the same PIN for general device access and for high-stakes actions like remote home entry means a single compromised PIN exposes both. Separating them limits how far one compromise can reach.

How did Amazon respond to criticism of Amazon Key's security?
Amazon added fingerprint authentication to the Android version of the Key app in March 2018, several months after the product's October 2017 launch, with iOS support to follow. It addressed part of the concern, but after the product was already in homes rather than before.

The Bottom Line

Amazon Key's fingerprint update is a step in the right direction, but it's a patch applied after the fact to a problem that better authentication design would have prevented from the start. Quality, the right factors in the right order, beats quantity, more layers added without rethinking the sequence, every time.