3 ms·

> an account that already exists. yes, but only if you don't have two factor authentication turned on. I still maintain that using biometrics as a quick login

• Terr_ 2y ago
  It sounds like you're suggesting someone can log in just using (A) biometrics and (B) a 2FA time-code generator. The problem there is that it's doubling up on "thing you have"[1], and there's no longer a "something you know" condition. A mugger could knock you out from behind while you're using your phone and then empty your bank account or whatever. [1] That said, fingers/irises/etc. aren't strong in the category of an un-copyable object either, since many scanners are fooled by fake fingers etc.
  • chii 2y ago
    > A mugger could knock you out from behind while you're using your phone and then empty your bank account or whatever. that's true, but they could also just point a gun at your head and tell you to empty your account. There's a balance of convenience and security. A lot of processes disregard convenience as a factor, but i argue that a laymen considers convenience a large factor, and would be willing to skip security for convenience.