Which is why, as I mentioned, you don't store the biometrics. You don't even send them to the remote service. Hash + Salt on the client, submit the result. Uni

Which is why, as I mentioned, you don't store the biometrics. You don't even send them to the remote service. Hash + Salt on the client, submit the result. Unique salt for each remote service, and you can change it for a particular remote service if it turns out they do stupid shit with it.