I'm not sure why you're downvoted -- I don't agree with your conclusions, but many of the sibling posts are making grand statements about "biometrics are usernames" while disregarding the threat model entirely.

I do disagree with a couple of your conclusions though, because the attacks you describe are all targeting you as an individual. There's a much broader class of attacks that should be worrisome -- adversaries seeking _any_ compromise of _any_ individual. Like getting a dump of passwords from neopets or something and trying all those passwords on Chase.

For that kind of adversary, password is vulnerable, and biometrics is secure. And that kind of adversary is by far the most dangerous and prevelant. Especially biometrics in the Apple secure enclave model, where the key material is secured by the biometrics but is very strong -- far stronger than a password can be.

For phone login and such you can't really attempt a password without being physically in front of the phone anyway, so any device from any individual doesn't really apply, in this case.

"For that kind of adversary, password is vulnerable, and biometrics is secure."

The applications I'm familiar with, the password takes precedence. It doesn't require password and fingerprint.

The thing is, if you add an extra factor, either you are required to use all of them, in which case it increases the risk of being wrongly locked out, or you are required to use any of them, in which case it increases the risk of the wrong person getting in.

I have an iPhone (fingerprints) and Android phone (password only). My adversary: my jealous girlfriend.

I found it functionally impossible to secure the android against my girlfriend as she could watch me enter any code or password multiple times.

She was not able to get into the iPhone, because the biometrics prevented her from being able to view the passcode being entered.

Summary: biometrics are a reasonable substitute for a trusting relationship. :)

Don't you ever find that the fingerprint recognition fails? And in that case, can't you use your passcode? If not, then you're locked out.

It fails very rarely mostly if my hand is wet. Yes you can use the passcode and you are required to enter the passcode at lease once a week by design. But opportunity for shoulder surfing is reduced by a factor of hundreds since I probably unlock my phone 100 times a day.

I would say there is one case where a fingerprint scanner is more secure than a password though, which is if you're trying to unlock your phone with someone peeking over your shoulder (or in an area with video surveillance).

There's also the "I have a complex passphraess for various apps/websites" but use iCloud keychain, 1Password, etc instead of typing in the password.

From a usability perspective, passwords are a nightmare, TouchID is a bit better (e.g. dry or wet fingers don't reliably work), FaceID is quite usable.

Apple seems the only company worth criticizing in this space.

You're correct about always having to evaluate security in terms of threat models, but you're off about a lot of your examples.

>Close person tries to get in (significant other, coworker, ...): biometrics is flawed, password works.

>Government respecting your rights tries to get in: biometrics is completly broken, password works.

The first is fully incorrect, the second far too generalized and heavily incorrect. PINs/passwords are far, FAR more trivial to skim then biometrics. Even mere shoulder surfing isn't hard, but in a world with approaching ubiquitous hard to notice downward looking cameras if you ever input a password anywhere that isn't physically secure, and with no one looking, you can easily have it compromised. And it of course takes essentially zero resource expenditure and offers zero visibility to merely use the password once it's acquired.

If it's at a random incident and a first-world type government wants to look, you can trivially disable biometrics on any decent implementation without even looking. So lack of biometrics buys you nothing. If it's a sting against you specifically then they can shoulder surf/camera it (remember the constant improvements in drones, are you REALLY not being watched well away from buildings even?) or just wait for you to unlock it and then swoop in and try to physically grab you while it's unlocked anyway. The scenario space where it'd make a difference is very, very minimal. Really, you want both: a strong password and biometrics for public usage. And for scenarios like border searches they can lawfully cause you enough inconvenience regardless that standard passcode is still not really the right response anyway. A burner, clean+remote load later, or alt-codes or the like would be the right way to go, though sadly I think only the first two are available right now.

>Government that don't respect your rights tries to get in: https://xkcd.com/538/

Possibly the dumbest xkcd ever made.

On the contrary, I think it’s one of the most accurate xkcd comics ever made. We’ve already seen how thieves savvy with how phone locking works will force you at gunpoint to disable any security; it doesn’t matter at that point how strong the encryption protecting your phone is at that point.