> But I'm responding to GP that said biometrics are a username, not a secret, which I agree. If you were sending an actual copy of your biometric data to the r

> But I'm responding to GP that said biometrics are a username, not a secret, which I agree. If you were sending an actual copy of your biometric data to the remote authentication service, then maybe you could make that argument. But that never happens, no FIDO biometric device sends a biometric fingerprint that could be reproduced by a different device. The device authenticates you with biometrics, then uses that data to unlock a private key, which is then used to answer a challenge-response request from the authenticating service. If you don’t the device, then it’s pretty much impossible for you to correctly answer that challenge-response, despite being in possession of the biometric features that device would use to authenticate you. So you can’t use your biometrics as a username. Because the device measuring the biometric data pushes that data through a mono-directional, randomly generated (at device manufacture), hash function, that exists within that device only. Take your biometrics else where (I.e same device type/model but different physical object), and you’ll get a different output even with identical inputs. Which would be a pretty useless username. > I'm not sure something you are counts as a security factor. You should take that up with NIST then: https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/m...