Pretty meh piece. This isn't so much "falsehoods programmers believe about Biometrics" as it is "strawmen and tired memes 'techies' toss around about Biometrics

Pretty meh piece. This isn't so much "falsehoods programmers believe about Biometrics" as it is "strawmen and tired memes 'techies' toss around about Biometrics". And sure enough at the end, the idiotic "biometrics are usernames" thing comes out. No, they're not usernames, nor are they passwords. They're measurements, any measurements, of our bodies. Hence bioMETRICS. They can be fingerprints sure (one of the oldest ones), but they can also be anything from faces and retina to the musculature of your ass or skeletal structure, your gait as you walk or patterns in how you type. Biometrics are a rapidly advancing but still fairly primitive field, but anything about someone's body that reasonably reliable bits of entropy can be extracted from can be part of an overall biometric pattern. Like ALL security, they are part of an economic equation as well as arms race in terms of how much time/resources attackers must expend vs how much users must expend and the value of attack. They're not silver bullets, but neither is anything else by definition. They can absolutely be an extremely useful part of a secure system for multiple reasons. Amongst them, two big ones are usability and threat model match. First, security systems are designed for and must be usable by some set of human beings at a practical level. The amount of time/resources the defenders need to expend has to be feasible and proportional. If that isn't the case then you simply end up with people working around it, the classic passwords-on-sticky-notes or add-one-each-required-rotation or whatever issues. Telling everyone they have to memorize 256 bits of entropy and then rotate it every 6 months and then having that fail to happen isn't a failure of the users, it's a failure of the security system because it's a shitty fucking system. Biometrics, properly done (like anything else), offer a significant number of bits that require a different attacker model to copy at high ease of use to the majority of users. The ratios alone make it worthy of consideration. Second, they flat out are better against certain common threat models. Like this bit at the end: If you think an enemy state is going to devote considerable resources to steal copies of your biometrics, consider changing to a different password mechanism. If you think a state actor is after you, well you're probably fucked. But that aside "just universally use passwords" is WORSE advice. We now live in an era of near perpetual over the shoulder high resolution video surveillance in many public spaces, ever cheaper drones that can offer the same anywhere outdoors, and extremely hard to detect cameras that can be quickly installed indoors. We have good enough storage and AI analysis to handle a lot of simple stuff, as China is putting into practice. From a fundamental ML standpoint, "a human entering a pin/passcode on their phone, tablet or computer" is a VERY regular pattern. The boxes or screens for entry, the result of entry (typically a bunch of dots), the patterns of input, all are highly regular in general. In turn, I'd be genuinely surprised if state actors aren't already at least testing universal wide scale automated password harvesting. Someone enters a password in view of a surveillance camera, and it automatically records their key entry in real time and matches it to their face. In contrast, good biometrics require some level of individual targeting and resource expenditure (this is a shifting target sure, but so is everything else in security). I'd certainly never depend on biometrics everywhere, but everything in sec is about layers and matching tools to threats. I do try to use biometrics and HSMs whenever I'm out in public, along with long master passwords that I enter in more physically secure areas. It's irritating to see them get dismissed so blithely by people who should know better, rather then recognizing they're a work in progress along with other authentication. And as far as state actors or even other lesser physical individualized threats go, frankly normal people just don't have the tools right now at all unfortunately. Dealing with attacks like that requires higher level composite tools like coercion codes or automated location/use/code based device views, all transparently implemented across major classes of devices and backed up and down the stack. Biometrics have a big role to play in that too, but they're just primitives along with other authentication factors for use in more complex applications.