Could you elaborate on your concern? My understanding of how most biometric auth works is that it functions a lot like passwords in that your features get translated into a non-reversible hash that should be meaningless to any other biometric auth system.

Yeah, assuming that my biometric auth is relatively strong, stays on my device, and is a device-specific hashed representation I have a hard time finding fault. I believe most modern phone's biometrics fit that criteria.

> stays on my device

Heh.

OK, so we're at that level of contribution, are we?

I'm just saying that the information staying on the device is aspirational.

I see that this skepticism has offended.

Well because, to me at least, it's less skepticism and more cynicism.

What do you think would happen if it didn’t stay on your device? Just trying to understand if there’s an attack vector I’m missing. What could one do with that information given how it is encoded?

Biometrics don’t require consent. Just hold up a friends phone towards their face.