Biometrics should be usernames, not passwords. Fingerprints, irises, faces, vocal patterns, all of it, no matter how good it is, only identifies the person trying to enter/use something and is somewhat easy to steal without their knowledge.
If you want true security you still need to ask for a passcode that only the now-identified user will know.
And yes, it is still possible to intercept the passcode at the moment that the user interacts with the locking mechanism, but that is completely different from grabbing it when they’re randomly walking down the street, etc.
(Edit to add: I didn’t think this needed to be explained, but I’m not saying biometrics should replace usernames, I’m saying they shouldn’t have replaced passwords. And yes, you can still use biometrics in the authentication process to identify that it’s you, i.e. your username, but you still need a password.)
The only form of authentication that will work long term is to run a hash on the entire person.
Basically instead of authenticating that it is the same person, you authenticate that whatever is attempting access shares enough characteristics with that person to use the resource in the same way.
Like, a perfect transporter clone of me can get access to my stuff, but it’s okay because he’s got my same goals and moral constraints.
What if you want to have more than one account with a provider, but you have only one face?
Are you serious or are you being pedantic and trolling? That doesn’t change my point, your face shouldn’t be the password to both accounts. It’s pretty easy to add another step for multiple accounts.
Ok, but the providers will not offer such a service. I’d gladly take 2fa using biometrics and a password/passkey with my username working as it always has.
Biometrics should be usernames, not passwords. Fingerprints, irises, faces, vocal patterns, all of it, no matter how good it is, only identifies the person trying to enter/use something and is somewhat easy to steal without their knowledge.
If you want true security you still need to ask for a passcode that only the now-identified user will know.
And yes, it is still possible to intercept the passcode at the moment that the user interacts with the locking mechanism, but that is completely different from grabbing it when they’re randomly walking down the street, etc.
(Edit to add: I didn’t think this needed to be explained, but I’m not saying biometrics should replace usernames, I’m saying they shouldn’t have replaced passwords. And yes, you can still use biometrics in the authentication process to identify that it’s you, i.e. your username, but you still need a password.)
The only form of authentication that will work long term is to run a hash on the entire person.
Basically instead of authenticating that it is the same person, you authenticate that whatever is attempting access shares enough characteristics with that person to use the resource in the same way.
Like, a perfect transporter clone of me can get access to my stuff, but it’s okay because he’s got my same goals and moral constraints.
What if you want to have more than one account with a provider, but you have only one face?
Are you serious or are you being pedantic and trolling? That doesn’t change my point, your face shouldn’t be the password to both accounts. It’s pretty easy to add another step for multiple accounts.
Ok, but the providers will not offer such a service. I’d gladly take 2fa using biometrics and a password/passkey with my username working as it always has.
I’m not saying biometrics should replace all usernames. I’m saying that they should be used as usernames/identification at best.
I have the same username at multiple websites…