Kensington VeriMark Guard (USB-C)

Kensington VeriMark Guard (USB-C): Fingerprint Key Specs

A fingerprint replaces the PIN step entirely on Kensington's VeriMark Guard, the first device in this lineup to build biometric matching directly into the FIDO2 key itself rather than relying on a laptop's own sensor. Certified for FIDO2, WebAuthn/CTAP2, and FIDO U2F, the key uses Match-in-Sensor technology that isolates fingerprint data inside the sensor chip, so only an encrypted match or no-match result ever leaves the device.¹ It supports up to 10 enrolled fingerprints and carries an MSRP of $49.99, positioning it between Yubico's budget and premium keys on price.¹ Because biometric authentication measures something fundamentally different from password entropy, a physical trait rather than a memorized secret, this page also covers where the two concepts intersect and where they stay entirely separate.

Specifications

How Match-in-Sensor fingerprint matching works, and why it isn't entropy

The VeriMark Guard's Match-in-Sensor design performs the entire fingerprint comparison inside the sensor chip itself, meaning your raw fingerprint image never travels to the host computer, only an encrypted pass or fail signal does. This isolates the biometric data from the same kind of exposure a stolen password database creates, since there is no fingerprint template stored anywhere an attacker could exfiltrate at scale.²

A different security factor entirely

Unlike a password or PIN, a fingerprint has no meaningful entropy measurement in bits, because you are not choosing it from a keyspace an attacker could theoretically brute-force. Biometrics fall under 'something you are' rather than 'something you know,' which is precisely why they pair with, rather than replace, the entropy-based secrets this tool measures; a fingerprint unlocks the key's cryptographic operation, but a PIN or password still exists as a fallback path.

Combining a biometric factor with a cryptographic key also means an attacker cannot simply replicate what you know, the way they could with a phished password. They would need physical possession of the key itself, and a fingerprint convincing enough to pass Match-in-Sensor verification, which raises the bar considerably above anything credential-based alone can offer.

The accuracy numbers: FRR and FAR explained

Kensington rates the VeriMark Guard at a 2% false rejection rate and a 0.001% false acceptance rate.³ The false rejection rate means roughly 2 in 100 legitimate authentication attempts get incorrectly rejected, requiring a retry, a usability cost rather than a security one. The false acceptance rate is the security-relevant figure: roughly 1 in 100,000 attempts by a fingerprint that is not actually enrolled would be incorrectly accepted as a match.

What the 0.001% false acceptance rate means in practice

That 0.001% figure exceeds the accuracy typical consumer fingerprint sensors report, though it still is not zero, which is exactly why FIDO2 hardware keys pair biometric unlock with an underlying cryptographic key rather than using the fingerprint match as the entire security boundary on its own. A device that relied purely on a 99.999% accurate sensor would still need a fallback for the roughly 2% of legitimate attempts the sensor itself misreads, which is exactly the gap the underlying PIN and cryptographic key are built to cover.

A known software issue, and what still needs a strong PIN

At least one independent review found Kensington's management software failed to launch on Windows 11 during testing, though the key itself continued to function normally for enrollment and authentication once fingerprints were registered through the operating system's own settings.⁴ If you hit a similar issue, registering fingerprints directly through Windows Hello or your browser's WebAuthn prompt sidesteps the standalone management app entirely.

Why the PIN still matters even with biometrics enabled

Every FIDO2 device, including the VeriMark Guard, still requires a PIN as a fallback authentication path for account recovery or for devices where biometric enrollment fails. That PIN's entropy matters exactly as much as any other PIN discussed elsewhere on this tool, since the fingerprint convenience layer does not change the underlying cryptographic requirements of the FIDO2 standard beneath it.

Choosing a longer FIDO2 PIN than the minimum a device requests, where the option exists, closes the gap between the fallback path's security and the biometric path's much lower practical guess rate, a gap worth checking directly by comparing a fallback PIN's guess odds rather than assuming the minimum length is enough. Most FIDO2 implementations also lock out PIN attempts after a small number of failures, adding the same kind of throttling protection discussed elsewhere on this tool for numeric codes, so a stolen key alone still cannot be brute-forced open in any practical timeframe.⁵