6 ms·

Dumb question: why are biometrics being used to replace the password, shouldn't the biometric replace the username?

sph 5y ago
Sounds to be like we're replacing the username and the password, i.e. something you know with username and your phone, i.e. something you have. It sounds like it's still a one factor authentication system, but different.
- alberth 5y ago
  Follow-up dumb questions: - so what happens if you don't have your phone at time of login? - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login?
  - maxfurman 5y ago
    If you don't have your phone, you can't log in. SMS 2FA has the same problem. You technically should be able to migrate from one provider to another, it remains to be seen how easy Apple and Google will make the process. That last one is a great question that I don't know the answer to.
    - judge2020 5y ago
      > You technically should be able to migrate from one provider to another, it remains to be seen how easy Apple and Google will make the process. On a UX level, the transfer to another syncing security key "provider" is going to be interesting, if they even do that at all - I kind of doubt they'll have a "transfer your iCloud passkeys to your Chrome password manager" and they'll instead say "go to each service and enroll a new security key via your new syncing key manager". On a technical level, I wholly imagine there'll be a tool that pulls iCloud Passkeys[0] via the MacOS Keychain application and then inserts them into your new key manager. 0: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys https://developer.apple.com/documentation/authenticationserv...
  - judge2020 5y ago
    > - so what happens if you don't have your phone at time of login? Depends on if they allow you to turn off password+2FA login entirely, which I only see being possible with something like Advanced Protection Program[0] which can already be used to enforce "Only allow authentication with my password+security keys; there is no way for Google Support to remove 2fa; if I lose the keys, the account's lost". > - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? I imagine they'll say "login to each website" (which you can do via iOS if you use qr android login[1]) then "re-enroll with your new provider", but I hope there will be an actual export/import or migration experience. > - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login? Assuming they don't change how Chrome and iCloud keychain currently works, everything synced should stay on your already signed-in devices, so hopefully you can continue to use your devices as authenticators until you can log into each service and register a regular, hardware key for sign-in. 0: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ 1: https://www.chromestory.com/2021/12/qr-code-2fa/#:~:text=Here%20is%20the%20experimental%20flag%20that%20I%20spotted%20today%3A https://www.chromestory.com/2021/12/qr-code-2fa/#:~:text=Her... I personally tried this with my iPhone, and my phone prompted me to use an iCloud Passkey. I was able to confirm that, by enrolling my iPhone as a security key on GitHub, then this 'BLE Webauthn' feature allowed me to sign in to GitHub on my desktop Chrome browser via my phone. Only downside to this is that the desktop must have a bluetooth card, but hopefully motherboards will continue to come integrated with wifi+bluetooth.
  - Hamuko 5y ago
    >if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? A good FIDO implementation will give you the ability to enroll multiple authenticators. In fact, if you can't, you're basically going against the WebAuthn spec. "Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Relying Parties SHOULD make use of the excludeCredentials and user.id options to ensure that these different credentials are bound to different authenticators." Basically, you should enroll your iPhone and a backup key. And if you get an Android device, you log in with the Android device using a backup key, and enroll the Android device and remove the iPhone. Alternatively, you remove the iPhone authentication using the iPhone, and enroll the Android device using an alternative authentication method (like traditional username/password).
  - avianlyric 5y ago
    > - so what happens if you don't have your phone at time of login? You can’t login. Same as it is with any 2FA system where you don’t have access to the second factor. > - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? At a minimum services should support multiple authentication devices/tokens. So you can enrol both an iOS device and Android device, or any other FIDO device E.g. YubiKey. This is already the standard approach for FIDO tokens, and basically a requirement for existing services, because we don’t currently have FIDO token syncing. I would hope that these syncing services will also allow you to export your private key. But that’s a slightly scary prospect because it would allow the holder of that key to authenticate as you anywhere. > - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login? Services will still need a credential recovery process. People lose phone etc everyday. I imagine your bank will happy reset your credentials if you turned up in-person holding government identification.
  - dane-pgp 5y ago
    > Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc If you don't accept their 10,000 word ever-changing terms of use, and if don't let them check for the marks on your forehead or right hand, then yes, you won't be able to buy or sell.
  - nyuszika7h 5y ago
    > - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login? You don't need an Apple/Google/Microsoft account to use WebAuthn on another website, it's based on the biometrics on your local device. Syncing that credential across your devices with the same account is just an optional extra feature.
  - anotheracctfo 5y ago
    Same thing that happened when my work required 2FA for checking email, I simply stopped checking email on my personal phone. Its not like InfoSec cares if the business functions, that's not their job.
- avianlyric 5y ago
  The expectation is that you also have “something you are” as provided by your devices biometric authentication. The standard allows for service to demand that the authentication device performs an additional factor authentication. Which is usually either a PIN or biometrics, and your device attests to doing this during authentication. So then you have two complete factors “something you have” (your phone) and “something you are” (biometrics) or “something you know” (unlock PIN for device).
  - sph 5y ago
    But I'm responding to GP that said biometrics are a username, not a secret, which I agree. I'm not sure something you are counts as a security factor.
    - avianlyric 5y ago
      > But I'm responding to GP that said biometrics are a username, not a secret, which I agree. If you were sending an actual copy of your biometric data to the remote authentication service, then maybe you could make that argument. But that never happens, no FIDO biometric device sends a biometric fingerprint that could be reproduced by a different device. The device authenticates you with biometrics, then uses that data to unlock a private key, which is then used to answer a challenge-response request from the authenticating service. If you don’t the device, then it’s pretty much impossible for you to correctly answer that challenge-response, despite being in possession of the biometric features that device would use to authenticate you. So you can’t use your biometrics as a username. Because the device measuring the biometric data pushes that data through a mono-directional, randomly generated (at device manufacture), hash function, that exists within that device only. Take your biometrics else where (I.e same device type/model but different physical object), and you’ll get a different output even with identical inputs. Which would be a pretty useless username. > I'm not sure something you are counts as a security factor. You should take that up with NIST then: https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/m...
    - Spivak 5y ago
- aaaaaaaaata 5y ago
  The "one" factor is a zk proof.
vlozko 5y ago
A username (or email, same thing really) is required because there needs to be an identity to match a source of auth to.
- postalrat 5y ago
  Why?
CyberRage 5y ago
From a theoretical point of view or practical? Username is simply an ID. Password is how we truly verify who the user is. Bio-metrics are just convenient because they are unique and hard\impossible to replicate.
- alberth 5y ago
  > Bio-metrics are just convenient because they are unique and hard\impossible to replicate. But if your biometric is able to be faked, you can't change it like you can change a typical text based password. There's no "reset your password" equivalent for biometrics.
  - CyberRage 5y ago
    Oh gosh... your raw bio-metrics are never stored anywhere... The signal from the sensor is used as a "seed" to generate key using robust cryptography Different sensors will output different "data" based on the sensor type.
    - hansel_der 5y ago
      > Oh gosh... your raw bio-metrics are never stored anywhere... right, who would do that... i mean for what purpose...
      - CyberRage 5y ago
        I mean you don't have to give it away if you think Google is storing databases of fingerprints for the lizard masters to track you down. FIDO simply wants to make authentication stronger, you can use hardware keys that have a key burnt into them which is unique and much harder to brute-force than passwords. Again according to how biometrics are described in whitepapers\industry, we extract features from the fingerprint\face sometimes very little compared to the actual biometric and use it to derive a key. that key cannot be reversed to get the original features and different algorithms use different features.
taeric 5y ago
I think, at the end of the day, there really isn't much of a difference between the two, for authentication. One is just a public part of who you are, and remains fairly static. An argument for keeping the username separate is it is often used for identification. That is, you identify on this site as alberth. Not as any biometric scan. Even if you change which finger you want to use to authenticate, you'd still be alberth to everyone else here. I think there are arguments on favor of letting you change a display name. Probably still would keep a name that is static. (What Twitter does?)
moritonal 5y ago
Stunning question really. I imagine (absolute guess) it's because biometrics provide a 1-100% likelihood of a match, not a unique ID?
0daystock 5y ago
I believe it's because people generally find the idea to be comfortable and familiar based on fictional representations in movies, etc. I'm of the opinion biometric information is totally private, yet easily spoof-able, thus should only be used to identity - not authorize - me.
hansel_der 5y ago
it's not a dumb question, but that will not stop anyone because biometric authentication works very well in practice (convenient and foolproof) despite beeing not very secure. i.e. lockpicking howtos and existence of glasscutters don't dissuade from having a locked front door.
epistasis 5y ago
Without making any explicit argument for it, what I see coming out of Fido and U2F are really changing the importance of the long-standing "something you have, something you know..." mindset around security. That prior mode was not helping us design system that take human capabilities of the user into account. Prior security seemed to focus entirely on attackers, and their agency, and what they could potentially do. But we also need to pay attention to what users can do in order to build a secure system. Requiring users to read domain name strings, potentially in Unicode, every time, and make sure they are correct, to prevent phishing, is a really bad design. Instead, have the website authenticate themselves to the user, automatically, and have the machine do the string comparisons. Similarly, the distinction between user and password for a biometric doesn't make much sense in this case. It's neither. The user is identified by a different mechanism, the biometric is merely a way for the device to see that the user is there. There are always lots of attack modes for biometrics, but they are convenient and good enough to capture nearly all common and practica attack modes. And a huge problem of the 90s and 2000s security thinking was focusing on the wrong attack modes for the internet age.
- avianlyric 5y ago
  > Without making any explicit argument for it, what I see coming out of Fido and U2F are really changing the importance of the long-standing "something you have, something you know..." mindset around security. That prior mode was not helping us design system that take human capabilities of the user into account. Don’t think that’s quite true. It’s continuation of the old “something you know”, “something you have” and “something you are” authentication factors, and the idea that at least two factors should be used to authenticate. The username/password approach is only a single factor, “something you know”. Common 2FA solutions use “something you know” (you’re password) and “something you have” (a device proven via OTP or SMS). FIDO with biometrics trades all that for 2FA driven by “something you are” (biometrics) and “something you have” (you’re devices Secure Enclave). You don’t send you biometrics to the service your authenticating with. Rather you’re using your biometrics to prove “something you are” to your device, which your device then mixes with a private key which proves you’re in possession of a known device. All of that is then used to authenticate with your service. In order to enable a cloud synced private key, you need the syncing process to require 2FA to enable new devices. The 2FA process can be clunky and slow, because you only need to do once per device enrolment. Indeed it’s need to be clunkier, because you don’t have a biometric factor available for use, as the enrolment process is normally used to onboard both a device and a device specific biometric factor. After that you’re device becomes a know authenticated device, which can be used as “something you have” factor for authentication. All of this isn’t a change from long standing authentication strategy. It’s just a refinement of process to make the underlying authentication strategy user friendly.
somethingAlex 5y ago
Fundamentally, if you want to support multiple, unlinked accounts per person you'll still need some sort of "account designator." If you don't then the biometric marker can just replace both password and username. The reason why the username exists for the password is because it's problematic to guarantee uniqueness of passwords across your users. One is unique and public and the other is not and private.
_trackno5 5y ago
Not it shouldn't. If you wanted to associate various devices (phone, laptop, etc) to the same account it wouldn't work. The fingerprint produced by each device is different. You associate biometric credentials to a username for that.
md_ 5y ago
The biometrics don't authenticate you to the remote service. They authenticate you to the device that has the keys that authenticate you to the remote service. Biometrics are a convenient replacement for a screen lock pattern/PIN, but not a necessary one, of course. https://www.wired.com/story/fido-alliance-ios-android-password-replacement/ https://www.wired.com/story/fido-alliance-ios-android-passwo... is a good explainer.
snowwrestler 5y ago
The short answer is that you can lose a biometric but still be you. So a biometric is not a username. Also, the biometric does not actually replace a service password in this instance, it just helps authenticate you locally to a device. The key on the device is what is actually replacing your password. Depending on the device or settings you choose, you don’t need to use biometrics at all if you don’t want to.

sph 5y ago

Sounds to be like we're replacing the username and the password, i.e. something you know with username and your phone, i.e. something you have. It sounds like it's still a one factor authentication system, but different.

alberth 5y ago
Follow-up dumb questions: - so what happens if you don't have your phone at time of login? - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login?
- maxfurman 5y ago
  If you don't have your phone, you can't log in. SMS 2FA has the same problem. You technically should be able to migrate from one provider to another, it remains to be seen how easy Apple and Google will make the process. That last one is a great question that I don't know the answer to.
  - judge2020 5y ago
    > You technically should be able to migrate from one provider to another, it remains to be seen how easy Apple and Google will make the process. On a UX level, the transfer to another syncing security key "provider" is going to be interesting, if they even do that at all - I kind of doubt they'll have a "transfer your iCloud passkeys to your Chrome password manager" and they'll instead say "go to each service and enroll a new security key via your new syncing key manager". On a technical level, I wholly imagine there'll be a tool that pulls iCloud Passkeys[0] via the MacOS Keychain application and then inserts them into your new key manager. 0: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys https://developer.apple.com/documentation/authenticationserv...
- judge2020 5y ago
  > - so what happens if you don't have your phone at time of login? Depends on if they allow you to turn off password+2FA login entirely, which I only see being possible with something like Advanced Protection Program[0] which can already be used to enforce "Only allow authentication with my password+security keys; there is no way for Google Support to remove 2fa; if I lose the keys, the account's lost". > - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? I imagine they'll say "login to each website" (which you can do via iOS if you use qr android login[1]) then "re-enroll with your new provider", but I hope there will be an actual export/import or migration experience. > - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login? Assuming they don't change how Chrome and iCloud keychain currently works, everything synced should stay on your already signed-in devices, so hopefully you can continue to use your devices as authenticators until you can log into each service and register a regular, hardware key for sign-in. 0: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ 1: https://www.chromestory.com/2021/12/qr-code-2fa/#:~:text=Here%20is%20the%20experimental%20flag%20that%20I%20spotted%20today%3A https://www.chromestory.com/2021/12/qr-code-2fa/#:~:text=Her... I personally tried this with my iPhone, and my phone prompted me to use an iCloud Passkey. I was able to confirm that, by enrolling my iPhone as a security key on GitHub, then this 'BLE Webauthn' feature allowed me to sign in to GitHub on my desktop Chrome browser via my phone. Only downside to this is that the desktop must have a bluetooth card, but hopefully motherboards will continue to come integrated with wifi+bluetooth.
- Hamuko 5y ago
  >if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? A good FIDO implementation will give you the ability to enroll multiple authenticators. In fact, if you can't, you're basically going against the WebAuthn spec. "Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Relying Parties SHOULD make use of the excludeCredentials and user.id options to ensure that these different credentials are bound to different authenticators." Basically, you should enroll your iPhone and a backup key. And if you get an Android device, you log in with the Android device using a backup key, and enroll the Android device and remove the iPhone. Alternatively, you remove the iPhone authentication using the iPhone, and enroll the Android device using an alternative authentication method (like traditional username/password).
- avianlyric 5y ago
  > - so what happens if you don't have your phone at time of login? You can’t login. Same as it is with any 2FA system where you don’t have access to the second factor. > - if I enroll on iPhone, is my identity forever tied to Apple or can it be migrated to Android if I ever wanted to change platforms? At a minimum services should support multiple authentication devices/tokens. So you can enrol both an iOS device and Android device, or any other FIDO device E.g. YubiKey. This is already the standard approach for FIDO tokens, and basically a requirement for existing services, because we don’t currently have FIDO token syncing. I would hope that these syncing services will also allow you to export your private key. But that’s a slightly scary prospect because it would allow the holder of that key to authenticate as you anywhere. > - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login? Services will still need a credential recovery process. People lose phone etc everyday. I imagine your bank will happy reset your credentials if you turned up in-person holding government identification.
- dane-pgp 5y ago
  > Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc If you don't accept their 10,000 word ever-changing terms of use, and if don't let them check for the marks on your forehead or right hand, then yes, you won't be able to buy or sell.
- nyuszika7h 5y ago
  > - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login? You don't need an Apple/Google/Microsoft account to use WebAuthn on another website, it's based on the biometrics on your local device. Syncing that credential across your devices with the same account is just an optional extra feature.
- anotheracctfo 5y ago
  Same thing that happened when my work required 2FA for checking email, I simply stopped checking email on my personal phone. Its not like InfoSec cares if the business functions, that's not their job.
avianlyric 5y ago
The expectation is that you also have “something you are” as provided by your devices biometric authentication. The standard allows for service to demand that the authentication device performs an additional factor authentication. Which is usually either a PIN or biometrics, and your device attests to doing this during authentication. So then you have two complete factors “something you have” (your phone) and “something you are” (biometrics) or “something you know” (unlock PIN for device).
- sph 5y ago
  But I'm responding to GP that said biometrics are a username, not a secret, which I agree. I'm not sure something you are counts as a security factor.
  - avianlyric 5y ago
    > But I'm responding to GP that said biometrics are a username, not a secret, which I agree. If you were sending an actual copy of your biometric data to the remote authentication service, then maybe you could make that argument. But that never happens, no FIDO biometric device sends a biometric fingerprint that could be reproduced by a different device. The device authenticates you with biometrics, then uses that data to unlock a private key, which is then used to answer a challenge-response request from the authenticating service. If you don’t the device, then it’s pretty much impossible for you to correctly answer that challenge-response, despite being in possession of the biometric features that device would use to authenticate you. So you can’t use your biometrics as a username. Because the device measuring the biometric data pushes that data through a mono-directional, randomly generated (at device manufacture), hash function, that exists within that device only. Take your biometrics else where (I.e same device type/model but different physical object), and you’ll get a different output even with identical inputs. Which would be a pretty useless username. > I'm not sure something you are counts as a security factor. You should take that up with NIST then: https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/m...
  - Spivak 5y ago
aaaaaaaaata 5y ago
The "one" factor is a zk proof.

vlozko 5y ago

A username (or email, same thing really) is required because there needs to be an identity to match a source of auth to.

postalrat 5y ago
Why?

CyberRage 5y ago

From a theoretical point of view or practical? Username is simply an ID. Password is how we truly verify who the user is. Bio-metrics are just convenient because they are unique and hard\impossible to replicate.

alberth 5y ago
> Bio-metrics are just convenient because they are unique and hard\impossible to replicate. But if your biometric is able to be faked, you can't change it like you can change a typical text based password. There's no "reset your password" equivalent for biometrics.
- CyberRage 5y ago
  Oh gosh... your raw bio-metrics are never stored anywhere... The signal from the sensor is used as a "seed" to generate key using robust cryptography Different sensors will output different "data" based on the sensor type.
  - hansel_der 5y ago
    > Oh gosh... your raw bio-metrics are never stored anywhere... right, who would do that... i mean for what purpose...
    - CyberRage 5y ago
      I mean you don't have to give it away if you think Google is storing databases of fingerprints for the lizard masters to track you down. FIDO simply wants to make authentication stronger, you can use hardware keys that have a key burnt into them which is unique and much harder to brute-force than passwords. Again according to how biometrics are described in whitepapers\industry, we extract features from the fingerprint\face sometimes very little compared to the actual biometric and use it to derive a key. that key cannot be reversed to get the original features and different algorithms use different features.

taeric 5y ago

I think, at the end of the day, there really isn't much of a difference between the two, for authentication. One is just a public part of who you are, and remains fairly static. An argument for keeping the username separate is it is often used for identification. That is, you identify on this site as alberth. Not as any biometric scan. Even if you change which finger you want to use to authenticate, you'd still be alberth to everyone else here. I think there are arguments on favor of letting you change a display name. Probably still would keep a name that is static. (What Twitter does?)

moritonal 5y ago

Stunning question really. I imagine (absolute guess) it's because biometrics provide a 1-100% likelihood of a match, not a unique ID?

0daystock 5y ago

I believe it's because people generally find the idea to be comfortable and familiar based on fictional representations in movies, etc. I'm of the opinion biometric information is totally private, yet easily spoof-able, thus should only be used to identity - not authorize - me.

hansel_der 5y ago

it's not a dumb question, but that will not stop anyone because biometric authentication works very well in practice (convenient and foolproof) despite beeing not very secure. i.e. lockpicking howtos and existence of glasscutters don't dissuade from having a locked front door.

epistasis 5y ago

Without making any explicit argument for it, what I see coming out of Fido and U2F are really changing the importance of the long-standing "something you have, something you know..." mindset around security. That prior mode was not helping us design system that take human capabilities of the user into account. Prior security seemed to focus entirely on attackers, and their agency, and what they could potentially do. But we also need to pay attention to what users can do in order to build a secure system. Requiring users to read domain name strings, potentially in Unicode, every time, and make sure they are correct, to prevent phishing, is a really bad design. Instead, have the website authenticate themselves to the user, automatically, and have the machine do the string comparisons. Similarly, the distinction between user and password for a biometric doesn't make much sense in this case. It's neither. The user is identified by a different mechanism, the biometric is merely a way for the device to see that the user is there. There are always lots of attack modes for biometrics, but they are convenient and good enough to capture nearly all common and practica attack modes. And a huge problem of the 90s and 2000s security thinking was focusing on the wrong attack modes for the internet age.

avianlyric 5y ago
> Without making any explicit argument for it, what I see coming out of Fido and U2F are really changing the importance of the long-standing "something you have, something you know..." mindset around security. That prior mode was not helping us design system that take human capabilities of the user into account. Don’t think that’s quite true. It’s continuation of the old “something you know”, “something you have” and “something you are” authentication factors, and the idea that at least two factors should be used to authenticate. The username/password approach is only a single factor, “something you know”. Common 2FA solutions use “something you know” (you’re password) and “something you have” (a device proven via OTP or SMS). FIDO with biometrics trades all that for 2FA driven by “something you are” (biometrics) and “something you have” (you’re devices Secure Enclave). You don’t send you biometrics to the service your authenticating with. Rather you’re using your biometrics to prove “something you are” to your device, which your device then mixes with a private key which proves you’re in possession of a known device. All of that is then used to authenticate with your service. In order to enable a cloud synced private key, you need the syncing process to require 2FA to enable new devices. The 2FA process can be clunky and slow, because you only need to do once per device enrolment. Indeed it’s need to be clunkier, because you don’t have a biometric factor available for use, as the enrolment process is normally used to onboard both a device and a device specific biometric factor. After that you’re device becomes a know authenticated device, which can be used as “something you have” factor for authentication. All of this isn’t a change from long standing authentication strategy. It’s just a refinement of process to make the underlying authentication strategy user friendly.

somethingAlex 5y ago

Fundamentally, if you want to support multiple, unlinked accounts per person you'll still need some sort of "account designator." If you don't then the biometric marker can just replace both password and username. The reason why the username exists for the password is because it's problematic to guarantee uniqueness of passwords across your users. One is unique and public and the other is not and private.

_trackno5 5y ago

Not it shouldn't. If you wanted to associate various devices (phone, laptop, etc) to the same account it wouldn't work. The fingerprint produced by each device is different. You associate biometric credentials to a username for that.

md_ 5y ago

The biometrics don't authenticate you to the remote service. They authenticate you to the device that has the keys that authenticate you to the remote service. Biometrics are a convenient replacement for a screen lock pattern/PIN, but not a necessary one, of course. https://www.wired.com/story/fido-alliance-ios-android-password-replacement/ https://www.wired.com/story/fido-alliance-ios-android-passwo... is a good explainer.

snowwrestler 5y ago

The short answer is that you can lose a biometric but still be you. So a biometric is not a username. Also, the biometric does not actually replace a service password in this instance, it just helps authenticate you locally to a device. The key on the device is what is actually replacing your password. Depending on the device or settings you choose, you don’t need to use biometrics at all if you don’t want to.