How long until a high resolution iris scanner can be embedded in a pair of sunglasses?

Point is it wasn’t long ago that nobody could fake your voice either.

Fingerprint scanning is going mainstream, heres a post about Amazon using palm scans on point of sale systems [1]. It seems reasonable that point of sale systems will get hacked or skimmers will get installed (common problems impacting normal people today). The current fix is to issue a new card. Unfortunately, you cannot have a new finger/palm print issued, so the threat appears unmitigated.

[1] https://www.bbc.co.uk/news/technology-54337984

This misses that if this happens I can just go back to using something else. I'm not forced to keep using my eye scan for life.

And I think theres 0 reported cases of this actually happening in the wild. So I think for any reasonable person, the threat level is quite literally 0.0000%. Maybe in a decade or something.

TouchID does seem a bit more risky, whereas FaceID I'd presume would require a pretty high end camera set up in a really well lit location. I definitely can see a motivated person coming up with something, but again, seems like only if I was a government agent or billionaire I'd worry about it. And they'd have to steal my phone too to even use it, which at that point I feel like they'd just do something more straightforward like pointing a gun at you.

The problem is not the high resolution scan of black hats it's that every company and your mom wants to store your biometric data in the future... and as we see with passwords most of them can't be trusted.

The bad guys don't need to scan your biometrics. Every site you log into with TouchID or whatever already has. Passwords get leaked all the time, and when you find out, you change them. You can't change your biometrics.

You’re fundamentally misunderstanding how TouchID or FaceID work.

The biometrics authenticate you with the Secure Enclave in your phone. The enrolled biometric data is stored within the Secure Enclave and practically unrecoverable. Authentication is done directly within the Secure Enclave. The connection between the sensor (fingerprint, camera) and Secure Enclave is direct and encrypted.

Conceptually, this is identical to using a passcode or password to unlock your device.

Once the Secure Enclave is unlocked, your phone can use it to sign requests, decrypt data (e.g., stored passwords), etc. The signed request or decrypted password is what’s transmitted to the app, website, or whatever else you’re authenticating against.

Your biometric data never leaves a secure encrypted channel between the sensor and Secure Enclave, and within the Secure Enclave’s own storage.

It’s some seriously cool hardware and the lengths it goes to to mitigate a lot of common and uncommon attacks is impressive. (It has a separate built in voltage and clock monitor with a wider operating envelope so if you try and voltage glitch it, it can lock and disable itself and require a reset. Bet Nintendo wishes they had thought of that.)

There are a _lot_ of details published about this.

Secure Enclave: https://support.apple.com/en-ca/guide/security/sec59b0b31ff/...

Overall platform security: https://support.apple.com/en-ca/guide/security/welcome/web

Well, there's WorldCoin.