# Digital Identity in the EU: Promoting eIDAS Solutions Based on Biometrics
## 5 Discussion  
The method proposed in this paper, in addition to strengthening the verification's accuracy, introduces a set of improvements that will be briefly discussed in the following. First, the usability is enhanced since it is no longer needed to remember complex codes or passwords to be prompted for the identification process. Some of the risks linked to the memorization of codes could be (i) forgetting them, which implies recovering them through an annoying procedure, and (ii) annotating them in a place where they can be stolen or accessed in a malicious way. Another relevant aspect regards the security of the system. In normal practice, centralized authentication servers are used to store biometric data. If these servers are compromised, the facial images of the users can be retrieved from the attackers. Another issue regards the liveness, i.e., the possibility that the user passes a photo retrieved online to fool the authentication system instead of taking one during the process [47]. The proposed method has a solution for both of these issues. First, the acquisition and the verification procedures are executed locally on the mobile device; thus, the sensitive biometric data (i.e., the probing images and the gallery images) are securely stored on the mobile device during the authentication procedure. After authentication, both the probe and gallery data are deleted and re-acquired with each authentication request. It is not necessary to exchange data through the network, unlike centralized systems. Moreover, the system includes intrinsic liveness detection since a video or a set of photos of the face needed to create the 3D model must be acquired live with the camera of the mobile phone. Finally, this method could be easily integrated into the standard identification scheme of CIE and does not require the use of special hardware (if the video reconstruction is used) making it compatible also with standard mobile devices. Note that the proposed mobile authentication scheme involves creating a 3D model of the user's face, which is computationally demanding. Modern smartphones, often equipped with depth sensors and powerful CPUs, can handle complex tasks like 3D rendering and studies have shown that mobile devices can perform photorealistic 3D reconstruction in real time using depth sensors [48; 49]. However, since not all devices have depth sensors, 3D monocular reconstruction could be necessary in some cases. Recent advances in deep learning have made this possible while maintaining accuracy and performance [50; 51]. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Method** & **TPR@FAR = \(10^{-3}\)** & **TPR@FAR = \(10^{-6}\)** & **AUC** \\ \hline \multirow{2}{*}{FRGC} & our & **98.62** & **76.03** & **0.9997** \\  & standard & 89.67 & 10.93 & 0.9842 \\ \hline \multirow{2}{*}{Bosforus} & our & **98.25** & **87.77** & **0.9992** \\  & standard & 97.49 & 87.74 & 0.9983 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Comparison of the performance of the proposed method (our) with standard 2D authentication methods (standard). Best values are highlighted in bold. A final remark concerns some additional issues introduced by the proposed method; these are briefly discussed below. * All manufacturers of mobile devices do not yet support NFC in all of their models;
* Each country could implement specific APIs since there are no universal guidelines for this development; consequently, different plugins would be required for each eID card to ensure the correct implementation of APIs for retrieving biometric data;
* Using a single biometric modality introduces weaknesses since it can be hacked or hijacked, even in scenarios where multi-factor authentication is implemented. A common practice recommends saving the evidence of the verification process (i.e., the probing image) for logging purposes. These data can cause problems with the storage capacity of the device;
* Modern attacks (like biometric spoof attacks, presentation attacks, video injection attacks, deep fake puppets, etc.)