As you should. They are amputationware. [Snark warning!] "We were compromised. Rotate your passwords, chop off your finger and change your face." [End snark]

As you should. They are amputationware. [Snark warning!] "We were compromised. Rotate your passwords, chop off your finger and change your face." [End snark] Biometric measurements are fuzzy, by their nature. This in turn means that for every stored biometric identifier, there is a whole range of inputs / input signals that will match. On top of that, the measurement devices are on untrusted systems. If you can compromise the device and extract the signal sent from the sensor, you should have a near universal replay payload. Right now that is still an espionage realm threat, but as these methods become more universal, mass attacks against large populations become more and more appealing. Archives of valid (username, password) tuples are already sold on underground markets. It's not much of a stretch to predict that (username, biometric sensor dump) archives will eventually become a commodity too.