Hacker News Reader

The world's moving towards a biometrically backed public-private key pair. Hope this is considered

I don't understand why people want to use biometrics. It's extremely insecure.

It's a very natural fit for ID (not password)

But also irrevocable once someone find a way to duplicate it in the eyes of the usually not that well designed system it's actually used against. It's even worse then using birthdays as a basic for IT numbers in that regards.

Not really. What I want a (mostly anonymous) ID?

you can't rotate biometry if its compromised

May be worth it for in-person reclamation of identity. Use biometrics only when acquired in person.

Beats having to dreg up my high school year book, social security card, birth certificate, and high school transcript (None of which are actually inspected of course).

How do you defend against / defeat replay attacks?

In person? When you're actually seeing that it's their thumb and eyes that are being scanned?

How do you, as a third party, know that the validation occurred in person?

How do you defend against replay attacks?

So you agree that if it is done in person, it'd be difficult to fake?

Biometry for verification of identity, not verification of intent.

Once you verify they are who they say they are, you can do a second step to verify they actually intend to do some secure action.

Reply on news.ycombinator.com