Berühr den Sensor. Eine WebAuthn-Authentifizierungsanfrage ruft die biometrische Hardware
deines Geräts auf — denselben Sensor, den deine Banking-App, dein Sperrbildschirm und deine
digitale Ausweisapp verwenden. Unten siehst du genau, was der Browser erhält — und was eine
native App stattdessen bekommen kann. In der Lücke zwischen diesen Listen lebt deine
Privatsphäre — oder verschwindet.
Deine Fingerabdruckvorlage verlässt die sichere Enklave nie — im Browser.
Native Apps, MDM-Profile und OS-APIs arbeiten unter völlig anderen Regeln.
Indiens Aadhaar-System hat zentral Fingerabdrücke von 1,4 Milliarden Menschen gespeichert.
Chinas Social-Credit-System verknüpft biometrische Daten mit Finanz- und Bewegungsprotokollen.
Das Entry/Exit-System der EU begann 2024 mit der Fingerabdruckerfassung an allen Außengrenzen.
Der Sensor in deinem Handy ist neutral. Wer ihn aufruft — und was mit dem Ergebnis geschieht — ist es nicht.
ready — press the button above
what the browser receives
credential id (site-scoped, non-portable)—
authenticator type—
user biometrically verified—
public key (COSE format)—
authenticator data (hex excerpt)—
what the browser never receives
fingerprint templatewithheld by secure enclave — cryptographic guarantee
ridge minutiae mapnever crosses the hardware boundary
biometric match scoreonly a boolean result is returned
enrollment imagedestroyed after template generation at enrollment
what a native app may receive instead
biometric match scoreavailable via proprietary OEM APIs on some platforms
enrollment metadatanumber of enrolled fingers, failure counts, last enrollment date
liveness / anti-spoof resultpresentation attack score — logged and transmitted by some SDKs
partial feature vectorssome banking and government SDKs expose geometric features, not full templates
sensor hardware identifiermanufacturer, model, and firmware version — fingerprints your device
▶ was gibt WebAuthn tatsächlich preis?
WebAuthn (FIDO2) is designed so that biometric data never leaves the device's secure
enclave — a hardware-isolated cryptographic processor separate from the main CPU.
When you authenticate, the enclave performs the biometric match internally and returns
only a cryptographic signature, not the fingerprint itself.
Native apps operate differently. Android's BiometricPrompt API and iOS's LocalAuthentication
framework give developers a result — but OEM-specific and enterprise APIs expose
substantially more. Government ID apps, banking fraud systems, and enterprise MDM
profiles often access enrollment metadata, liveness scores, and partial feature data,
sometimes with explicit consent buried deep in terms documents, sometimes without.
The credential ID shown is scoped to this domain and cannot be used to link your
identity across other services. That constraint is WebAuthn by design.
Native app databases are not bound by it.