We should understand the attack model better and the likelihood of a successful eye capture. We know that it's certainly less hard than knowing someone's passw

We should understand the attack model better and the likelihood of a successful eye capture. We know that it's certainly less hard than knowing someone's password given a semi sane password policy, but more difficult than scraping fb selfies and printing them. Thinking out loud, I certainly don't share my phone password with my eye doctor, so there's one example of disclosure.