Hacker News Reader

They don't necessarily serialize and send your biometrics over the internet. FIDO biometric implementations, for example, use it to unlock an on-device private key, which is then used to sign a challenge for the server to authenticate. No secrets, biometrics included, leave the device.

View on HN

So how would I be able to use a new device to authenticate using an existing account. How would I be able to do that if the original device was cast into the fires of Mount Doom?

IMO biometric auth will never completely displace passwords unless it can beat the user experience of a password manager.

But, as it may be obvious, I really don't understand how the biometric stuff works.

The simple answer is that generally you don't, you first authenticate in some other way and then add biometrics (stored on the device) as an alternate means of authentication. It displaces other methods as the day-to-day commonly used authentication, but not completely.

Reply on news.ycombinator.com