Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The debate about username vs. password can be more formally described as a debate about public part of the credentials vs. private part of the credentials. Let us call them public identifier and private identifier.

One very important property that I expect any private identifier to satisfy is that it can be changed once I believe it has been compromised.

My fingerprint data cannot be changed, once compromised. Therefore it cannot be a private identifier. Thus this is not a password. What is not private should be considered public by Kerckhoffs' principle. Thus fingerprint data should be considered to provide the same level of security that a username provides.



But even assuming that your fingerprint is publicly known, depending on the quality of the scanner, it can still be very difficult/expensive to create a good-enough artificial finger. Even more so for FaceID, I imagine.

That's where comparison with user names or passwords breaks.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: