I disagree. It's a disclosable but non-revokable authentication mechanism. If your fingerprints leak, there's no way to revoke them. If your fingerprints change, like with your friend's kid, you'll find that the systems are not designed to handle updates. It's an ID that you cannot discard but might accidentally ruin.
>Jan Krissler, known in hacker circles as Starbug, used commercial software called VeriFinger and several close-range photos of von der Leyen, including one gleaned from a press release issued by her own office and another he took himself from three meters away, to reverse-engineer the fingerprint.
Using your fingerprint instead of typing a username? Fine.
Using your fingerprint instead of typing a password? Uh oh.
But good luck with that.
It started with just having Name / Card Number / Expiry, all of which are printed right on the card, being all that was necessary to conduct a transaction.
Then they put a magnetic strip on the back of the card and storing the same information in plain text on that strip.
Then they started printing a "secret" 3 or 4 digit number (CVC) on the card for "extra" security.
Now we have chips in cards which helps with brick and mortar transactions in an era when most transactions are online.
At present, I transfer money into my checking account for each and every outgoing transaction, so there's both a small time window and a small limit on the amount of a theft, and I have less to worry about giving out my checking account number for incoming transfers.
Mildly related: At one point I was considering how easily someone could make an e-mail server where valid addresses were all in the form username+code@host, where users could create/manage valid codes using a smartphone app, noting which ones were for which purpose and having inactivity or expiry rules.
Unlike current user+anything@host forms, a the + component would be mandatory, and an incorrect/expired code means spam filtering.
(I’m not an anarchist or well-funded criminal though, so I agree with you.)
Biometrics for authentication/authorization are terrible, at least as currently implemented.
There is already a lot of truly immutable and practically immutable data that's tracked.
The other issue is the courts have dictated that you don't own your own biometrics. Phone locked with face or fingerprint? They can get a court order that allows them to force unlock it.
A pin code is considered more secure, because it can't be force bypassed, like biometrics.
1. https://fuscolaw.org/police-cant-force-you-to-unlock-your-sm...
(highlighting is mine)
This decision overrules previous circuit court rulings in California that biometric features were considered testimonies since suspects weren’t verbally giving up their numeric passcodes or passwords.
2. https://jsberrylaw.com/blog/can-police-officers-force-you-to...
The method by which you choose to lock your cellphone can make the difference between being required to unlock it for a police officer or not. Police officers cannot force you to unlock your phone by a testimonial act that reveals the contents of your mind. You can be forced to unlock your phone by a nontestimonial act.
Nontestimonial acts are things like your biometrics, your DNA, etc.
I just realized we thought we were being a bit cute by giving them names that meant the same thing, but in different languages. Now, I realize that if they translate their names into written Chinese, they better be phonetic translation... if they end up with identical names, same birthday, identical DNA, that could cause problems.
Now you could argue that in many situations you don't need to verify someone's identity and shouldn't have the right to do so; but if you do (like during border control) then your identity isn't supposed to be private.
The problem with DNA, as with fingerprints, voiceprints, retina scans, and the rest, is that a small sample or simulacrum of the original object or characteristic can often create a false positive.
You leave your fingerprints, and DNA, on everything you touch, literally. Your voice is now being recorded in high fidelity at great frequency, and your eyeballs are visible to whatever it is you are looking at.
The original use-case for computer passwords, as inveted by Fernando Corbato, was in a specific facility, with a physical location and at least reasonably-limited access, largely as a measure to prevent either accidental or typically prankish mis-use of other people's computer resources. The "universe" was a few score people.
We're now relaying on passwords (and numerous other proxies for identity attestation) in a universe of roughly ten billion people, with remote 24/7/365 access and highly-automated attacking systems, over a channel which provides very narrow capabilities for high-credibility, non-spoofable assertions.
For humans interacting in person, there are many simultaneous indicia of who an individual is, particularly amongst people well-known to one another: visual appearance, voice, height, gait and carriage, mannerisms, and personal/intimate knowledge. Even for in-person identity assertion, these factors break down at scale, as our primate brains can recall the features of a few score individuals, but not many hundreds or thousands, let alone billions.
(An interesting exercise is to consider the span of a year, or your life, and how much time you could dedicate to n number of people in that time. Even over a lifetime, you can only get to know perhaps 50,000 people for an hour or more 1:1, roughly a medium-sized town's population. Not even a large city, let alone a state/province or nation, let alone the global population.)
I'm coming to feel that the idea that we can transact significant interactions at this scale (population, distance, time) may well prove to be greatly flawed. Airgapping and limited access have their benefits.
If you're referring to Adenovirus vector COVID-19 vaccines, I believe episomal replication makes their DNA short-lived in the host. Also, as it's never reverse-transcribed into the human genome, there's a semantic argument that the Adenovirus DNA is never a part of the person's DNA, even when it is short-term resident in the nucleus.
Though, I suppose there might be some rare form of translocation that might still result in Adenovirus DNA being incorporated into the Human genome. I don't know enough about viral genetics to know the corner-case caveats associated with the claims that Adenovirus vector vaccines don't modify human DNA.