Fingerprints (and other biometric data) is the analogue of a (public) username and not the analogue to passwords:
> http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...
HN discussion:
> https://news.ycombinator.com/item?id=8496797
So if you replace entering your username by a fingerprint, retinal scan, ... this is perfectly fine from a security perspective (though IMHO a really bad idea from a privacy perspective). On the other hand using biometric data as replacement for passwords is from a security perspective an anti-pattern.
I like the parent's overall point, but I suspect its business model is not viable.
Any service that helps the user against the publisher's interests will need to be funded through charging the consumer. Not easy these days.
Nevertheless, you're probably right about the business model. I was piggybacking on the idealism of the article we're commenting on. It's fun to just discuss possible futures without worrying about viability once in a while.
I am aware that "fingerprint" has different meanings, but the grandparent explicitly talked of biometric authentication (e.g. physical fingerprints) in his last sentence:
> I would prefer this to any of biometric authentication schemes that have been peddled as "passwordless."
This is what I was referring to.
[1]: https://en.wikipedia.org/wiki/Device_fingerprint [2]: https://panopticlick.eff.org/
A person could potentially have a number of identities that are anonymous or pseudonymous, that are automatically created and detected whenever they use the internet. They could maybe view a dashboard of their identities on a secure device, link them by function and scope, expose personally identifiable information through them at will, and create policies to automate all this.
Eg. if I visit a site like HN more than twice, it could just create an anonymous account for me automatically through fingerprinting and log me in automatically. Then, if I want to link this account to other services or other devices, I could do that through some general purpose API on a secure device. This could potentially lead to a general purpose "consumer identity" system where a person's offline behaviors are brought in as well.
My point is there's no reason why the most advanced forms of tracking and identity management can't be brought under users' full control for our own benefit. Fingerprinting is treated like the internet's dirty secret, but it's a technology that could be used in different ways. I would prefer this to any of biometric authentication schemes that have been peddled as "passwordless."