3 ms·
I completely agree with some of what you said. But the point is that we should stop trying to make biometric security issues more accessible by making false equ
by curun1r 9y ago
I completely agree with some of what you said. But the point is that we should stop trying to make biometric security issues more accessible by making false equivalencies with well-understood authentication methods like username/password. It loses nuance and just causes problems.
With a username, I can abandon the account and sign up for a new one with a new username. I can't do that with biometric auth. And unlike a username, it requires an advanced adversary to be able to fake it, so it's also unlike traditional usernames in that way. Unless, of course, you somehow have an unconscious principal, in which case biometric authentication can be significantly less secure than a username and password, which wouldn't be divulged by someone unresponsive.
Biometric auth can also be much more secure under certain circumstances. When you combine it with, for example, a security guard that ensures that someone is using their own fingerprint/eye/face/etc, biometric authentication can make more sense than username and password. It's entirely situational which one works best.
There's entirely too many people who think it's clever to notice differences between biometric authentication and passwords and to say that it's, instead, a username. And it's just flat wrong and needs to be called out. It's also flat out wrong for Apple to have equated it with a password in the first place, so that should also be called out. It's all identity and the security of identity validation is always situational. There are no universals and exploitable flaws hide the empty space when we try to put square pegs in round holes.