Agreed. Biometrics doesn't even quality as something you have. It's something that you are. If your physical key gets compromised in some way, you can generally have a new one issued. But you can't just re-issue your face.

You can, it’s just risky and expensive and probably not something you want to do.

Biometrics is third-factor authentication (something you are). Its purpose is to supplement second-factor authentication (something you have), which is in turn meant to supplement first-factor authentication (something you know). You can also add a fourth factor (somewhere you are, or location) as an additional authentication factor as well. But it's this key point --that biometrics is meant to be one layer of multi-factor authentication -- which vendors seem to have ignored by conflating its function as supplement with its function as replacement, which it is decidedly not.

It seems similar to a personal challenge question like "What is the name of your High School". Your face is public information, just like that knowledge, but can be used in a security process to statistically decrease security breaches.

The way it was explained to me is, a fingerprint (or whatever) is quite difficult to copy...but as soon as you scan it and send it over a network for verification, it's no longer a fingerprint but a datastream just like any other password, except that this is a password you can't change if it gets compromised.

Therefore, biometrics can conceivably be useful if used cautiously on a single device or a well-secured local network. As soon as you start sending them over the public internet or anywhere else that it's possible for a hacker to intercept, all advantage is lost.

If you're sending the biometric over the network you're doing it wrong. Apple uses a secure enclave and the biometric (fingerprint or facial scan) never gets extracted from the chip, ever.

One would hope it's properly salted before being sent over any kind of network.

On the other hand, biometrics is a quite decent username, better for this purpose than some nickname or email address.

> On the other hand, biometrics is a quite decent username, better for this purpose than some nickname or email address.

Well, biometrics may be better than an a third-party email address in some cases (harder to lose throguht third-party action), but often worse than a first-party email address (e.g., Gmail for a Google account) or a nickname, for the same consideration.

Right you are!

I disagree. It's far easier to look over somebody's shoulder as they type in their password than it is to 3D print a copy of their head. I think most of the disdain for biometrics on phones is because Apple were the ones to popularise it, and tech people hate anything Apple does.

>I think most of the disdain for biometrics on phones is because Apple were the ones to popularise it, and tech people hate anything Apple does.

I've been hearing the exact same arguments against biometrics in every thread on the topic long before Apple even did biometrics.

Still works better as authentication than a 4-digit PIN or 4-point unlock pattern that you're entering right infront of strangers tens of times a day.

<something you have> + <something you know> = <something you are>

Sounds ok to me, at least in the weird arithmetic of this tired talking point that invariable makes an appearance every time the subject is discussed, usually in a tone of letting us in on some great, newly discovered revelation.

It's hard to resist stating "1+1=2" when everyone knows it's true but keep behaving like its not.

I don’t think people keep behaving like it’s not true. They just have different priorities.

Yes, “something you have + something you know” is more secure, but security is not a binary thing, and people’s real world behaviors need to be accounted for.

Before biometric authentication was available in cell phones, I had no passcode at all. My device’s security was just the physical security of the device itself. Constantly entering a passcode was just too much hassle, let alone a proper high-strength passcode. Moving to biometric authentication massively improved my security. Lots of people I know were in the same boat, or maybe had a four-digit passcode equal to their birthday and/or ATM PIN.

It’s not foolproof but it’s good enough for almost everyone.

It could be a combination of something you have (your face) and something you know (for example, that your right eyebrow has to be raised for face unlock to work).

nice idea

Biometrics is a difficult-to-guess user_id and not much more.

Within the security & digital forensics industry, it is best practices to require a minimum of 3 separate biometrics for anything requiring financial authentication capabilities. Apple is not respecting this best practice.