I don't think the next world war will be fought with nukes, it will be an economic fight. Leak a few corporate secrets [1] to stall the economy, use the OPM dump and this Equifax dump to originate enough false loans to seize up the financial sector, then cause havok across the electrical grid [2] like you did during the annexation of Crimea just to make sure they stay down.
We've been blind to the other half of the threat of centralized information repositories... the 1984 Big Brother scenario assumes the holder of the information wants to control the citizens, but we never considered the information might have leaked to an actor who wants to destroy the citizens.
[1]: https://en.wikipedia.org/wiki/Sony_Pictures_hack [2]: https://www.wired.com/story/hackers-gain-switch-flipping-acc...
Biometrics would be a terrible idea. Mass surveillance, anyone?
What if the biometrics were stored on something you have - say a smartcard (definitely not a phone!)? Along with a PIN. Plus, these two items went into a "write only" store on the card (actually, a hashed value of both are stored).
You have a card reader (one at home - and any place you are doing a transaction to confirm identity also has one). You put in your card. Type your PIN. Present your (physical) biometric.
The reader takes the data, passes it to the card (or maybe the card has the reader and pin pad?). The card runs the hashing again, and compares the values. If all is good, it outputs a "Yes" otherwise a "No".
Remember, only the card holds the data (a hashed version) of the biometric and the PIN. That can only be written (you can do this with your terminal at home?). The only output the card has is that "yes/no" value.
All transactions of such nature would be done with this card.
I'm probably missing some steps or such - but the idea is there. That gives a 3-factor authentication system.
Don't expect it to ever be implemented.
This event is leading me to about how social security numbers can no longer serve the role that they have with establishing trust in identity, although they can continue to be used to uniquely identify a US citizen. This hack may push markets, and government, to widely adopt biometrics and other sensitive, personally identifiable information.
What won't happen, unfortunately, is the political will to regulate how uniquely identifiable personal information is managed and stored.
Suppose that rather than Equifax, Facebook were hacked. What kind of intelligence and reports does Facebook have on people that would eclipse that of social security numbers and credit history?