This article does not get off to a promising start. It begins right off by mixing in completely orthogonal concepts, like privacy. It then has a random unsubsta

This article does not get off to a promising start. It begins right off by mixing in completely orthogonal concepts, like privacy. It then has a random unsubstantiated and unsupported side swipe at a single specific semi-obscure joint US-Canada program with some conspiracy mixed in. Author then screws up how false positives/negatives work in the context of authentication, perhaps partly because their mind has already jumped the tracks here and switched to some panopticon thing rather then, you know, authentication. Author writes: >"If you have a giant database of fingerprints or retinas or DNA samples or voiceprints or faces, and you have an algorithm for searching the database, and you have one sample you want to look up in the database to find the right match" Sure that'd be the case for mass surveillance, but not for auth, be it on a phone or in the NEXUS program author cites. The individual is registered (in person) in the database and are asking that they, specifically, be authenticated, and obviously their biometrics are linked with their other info (like name). It's not "we see some random person, try to find them in the db" it's "This person states that they are John Doe, and are asking to be authenticated as such by presenting the following factors", so their specific entry is being pulled up and the factors compared just to that, which generates a result of some level of confidence which either meets the target threshold or fails. False positive would be somebody who isn't John Doe being successfully authenticated as John Doe, and false negative would be the real John Doe failing to be authenticated as John Doe. More factors, higher quality of individual factors, and more powerful comparison systems can raise the confidence level. Better ones do so at a more efficient time&cost ratio for the defender vs attackers. There is some interesting stuff in this, and it touches on the important enrollment problem, but it also seems like a lot of unrelated tangents and wild goose chases mixed in. There also seems to be repeated instances of the classic screw up so common in security discussions (like those who cite that garbage xkcd) of failing to always remember that all security is an economic equation. Always have to keep that in mind or one can naturally fall down an endless hole and completely forget what the point of it all is.