Hacker News Reader

Biometrics seem worse-is-better: you now have some unique identifier for me, which is totally swell until the inevitable DB breach.

Which breech will likely be due to an Admin whoopsie of some sort.

Because the people remain the weakest link.

View on HN

Could you elaborate on your concern? My understanding of how most biometric auth works is that it functions a lot like passwords in that your features get translated into a non-reversible hash that should be meaningless to any other biometric auth system.

Yeah, assuming that my biometric auth is relatively strong, stays on my device, and is a device-specific hashed representation I have a hard time finding fault. I believe most modern phone's biometrics fit that criteria.

> stays on my device

Heh.

OK, so we're at that level of contribution, are we?

I'm just saying that the information staying on the device is aspirational.

I see that this skepticism has offended.

Well because, to me at least, it's less skepticism and more cynicism.

What do you think would happen if it didn’t stay on your device? Just trying to understand if there’s an attack vector I’m missing. What could one do with that information given how it is encoded?

Biometrics don’t require consent. Just hold up a friends phone towards their face.

Reply on news.ycombinator.com