Citation needed? A fingerprint can absolutely be used to generate a hash that functions as a pointer to primary keys.
Systems that try to do this in software are always trivially circumvented because you can just change the software to allow ‘not enough matches’ instead of ‘enough matches’. The key is necessarily in the device and software can’t protect it.
Because all of those apply to user IDs.
TLDR yes, biometrics are the closest thing to a user ID
> Are you seriously arguing a fingerprint is an aesthetic symbolic pointer in the way a name is? Absolutely. A given name is non-unique, and not chosen by you. Yet everyone refers you by it, if only by convention.
> That you are going to just refer to other people (whether IRL or online) by "fingerprint"? No but computers might as well do, much as you identify someone by their face. You might refer to someone by their public key fingerprint too (also similarly non-collision resistant)
> That people choose their fingerprints based on what they think will be a good one? People rarely choose their names, nicknames, or usernames. Why is choice an issue here?
> That there can just be a simple process to arbitrarily change their fingerprint if they later decide they'd prefer another one? People find it difficult to arbitrarily change their face, most are reluctant to change their given names - and indeed there's significant pressure from 'the system' to make it difficult for you, and also what about the many who find it annoying when their preferred username is unavailable, etc. I can't see what your point is here?
> Because all of those apply to user IDs. A user id, isn't a primary key in the real world - only when it comes to a particular computer system.
Finally your fingerprints do change over time, though not necessarily in a manner which will confuse current matching techniques
My point is a user name is something everyone knows i.e. not a secret.
Biometrics are not a secret as they are, in the case of fingerprints - easily picked from your Starbucks coffee cup, the door you just opened etc.
Your face is permanently on display.
Etc.
Your assertion that biometrics are not user-name equivalent is embarrassingly ignorant and you've already shown your inability to read or show much comprehension.
I shall therefore assume that you're unused to rational discussion and leave it there.
It's so odd to me that we consider fingerprints "something you are". Fingerprints surely are "something I have" in that I can lose them by disfigurement or maiming. "Something I am" is more like my DNA which can't be taken from me to the point of loss, unlike someone cutting off my fingers which would deny me access to whatever system it's used for.
so if you're merely saying (as i think you are) that biometrics make poor usernames, much as they make poor passwords, your argument is quite trivial/tangential to this thread and really doesn't address the point op is making and doesn't contribute to the thread in any meaningful way (unless you wanted to expound specifically on why its so important for usernames to be, mutable?)
and if, instead, you're saying, as you implied to me, that biometrics make better passwords than usernames, i'll reiterate: that's wrong.
Names/User IDs are not equivalent to biometrics. Nor passwords. Nor tokens. They are symbols that exist to enhance human UX. That's it.
>remember the context of the comment you criticized is that there are vulnerabilities in biometric security
Yes, just like in every single form of authentication. Which is utterly irrelevant.
>so if you're merely saying (as i think you are) that biometrics make poor usernames, much as they make poor passwords
>that biometrics make better passwords than usernames, i'll reiterate: that's wrong.
These are utterly non-sensical statements. Biometrics are not user names (a public symbol) nor are they passwords ("something you know"), "poor" has nothing to do with it, they are one of the other two classes of unique authentication factors. They have their own strengths and weaknesses, and yield different practical results when combined with one (or both) of the other two in a multi-factor authentication system. And a biometric/token MF system can absolutely be superior in security for many common threat scenarios and use cases compared to passwords. Achieving good security requires intelligent deployment of all 3.
Really? Please describe such a system. Will it use a photograph of the fingerprint? A hash value? What hash? How do you deterministically arrive at the exact same one each time, or do you plan to "change the user name every single time" and in that case what is the actual persistent pointer to the account/person? Do you expect people to then use that name in conversation or when they think about it?
See, this makes no sense. That's not what "user names" are, it doesn't have any of the properties humans ascribe to them.
>similarly, lots of applications use the fingerprint as both username and password
Name them. Name one, for that matter.
You seem very, very confused about all this but at this point I really don't know how to make it any clearer for you.
you are defining terms one way and i have defined them another way (that's fine) so that is why we cannot come to agreement on any corollary.
the distinction is that you are sticking to the "formal" definitions, while i am using "functional" definitions.
we agree (troll test #1) that auth factors can come in 3 flavors (for the 100th time): something you know, something you have, and something you are. according to this definition, a fingerprint goes into one bucket ("are") and a password goes into another bucket ("know"). peachy. BUT, fingerprints are also something else: GREASE. grease left on a handrail doesnt fit into any of these buckets. that doesnt mean its not a fingerprint!
do you see the point? if you can appreciate that, and look at my comments through this lens, they might make sense. functionally, programmers are free to use "usernames" QUA "passwords" if they want to -- we can't just define that out of existence.
and then about usernames: maybe you're just saying, hey i can't just swipe my finger at gmail.com because which gmail account am i logging into? do i need 1 finger for each account (business, personal, etc)? lol that's kind of valid point too but nobody is proposing that the biometric identifier is the only part of the username anymore than your browser fingerprint is (which google does indeed utilize; sign in from somewhere else and you'll get 2FA vs on your own device, etc etc). think of your biometric data more like your phone number in 2fa. its yours and can help to verify your identify but its not secret and your authenticator should be secret