a biometric is a username and a password
- yes, i know the purpose is to say that the biometric should be used as a password, but that changes the declarative statement quite a bit in my opinion
IE. You can change your password, you can't change your thumb/face/biometric (easily).
At best, a fingerprint establishes identity, therefore it has more in common with a username, drivers license, social security number, etc. than it has in common with a password.
Ideally you have a user name, a password, some sort of 2FA and also biometrics.
But the alternative for iPhones was leaving them without even a PIN because entering a 4 digit numeric pin was too much hassle for most people... so Apple lowered the bar and increased security with biometrics.
They are trying to do it again.
If you want ultimate security ,then you can have a very long alphanumeric password, and turn off touchID and faceID
Nope. At best a fingerprint establishes identity in a unique and authoritative manner. My name is an identity, and anyone can say or write my name. My SSN is an identity, and anyone can say or write my SSN. No one else can speak, type, write, or otherwise express my fingerprint. That is far beyond simple "identity".
Neither can you. You can only show your fingerprint for inspection - and so can anyone else.
And, unlike SSN or even your name, you leak fingerprints (and facial info) everywhere, all the time.
That's the point. It's not something I know, it's something I am and only I am that thing.
And unlike a password, if you want my fingerprint you have to be physically near me, and if you want to authenticate as me you need my authentication hardware. A Brazilian hacker isn't going to unlock my iPhone without first flying to the US and then locating me in both space and time to gain access to my fingerprint and my phone simultaneously. But with a password, they could easily go to www.gmail.com and type whatever they want from the comfort of their own home.