These unique personally identifying bits of information are not private keys. Private keys on the other hand can remain secret even when someone is confirming

These unique personally identifying bits of information are not private keys. Private keys on the other hand can remain secret even when someone is confirming their validity. To oversimplify a little, the way it works is that the private key is input into a one-way algorithm that generates an output they check against their saved values. If the output matches twice then they know you have the same key as the one you used in the past. They cannot used the output of a one-way algorithm to discover what the input was that generated said output.