11 ms·

Your biometrics cannot be changed nor revoked; they are neither a login nor a password.

• renton_tacos 7y ago
  They are a weak mechanism against individual targeted attacks, but a great mechanism for herd immunity. It's not perfect, for sure, but it helps raise the posture for the general user in a way that's easy and accessible. That's a win, imo.
  • CraneWorm 7y ago
    > They are a [...] great mechanism for herd immunity. I don't see how, could you elaborate what you mean? Imagine a leak from a database storing biometric keys, is this a disaster on par with a normal leak? In my opinion it's even worse! You might say we only use biometrics for a local authentication, but that would limit their application. If you convince people biometrics are great, such database will inevitably be created - what are the chances we store and guard biometrics better than we do with passwords?
    • ryukafalz 7y ago
      Sure, but keep in mind the prerequisites for using that leaked data. You have to either place yourself in between the sensor and the rest of the device or physically recreate the biometric with enough fidelity to fool the sensor. These are both possible, yes, but they’re significantly less trivial than using a password. This, by the way, still also requires physical access to the device if used for local authentication. And in the event biometrics are used in a physical location (which I’m not personally a fan of, but let’s consider it anyway), there’s often also a human there as well. Your clever mask may fool the sensor, but it probably also still looks like a mask to the guard behind the desk.