Fingerprints are Usernames, not Passwords

All these academic arguments about the security of fingerprints are interesting but completely are detached from the day-to-day use of TouchID. I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake fingerprint, and then they'd have to enter…

Fingerprints are not passwords, but I don't think it's useful to think of them as usernames either. This is a much more pragmatic take on it by Troy Hunt, the person behind “Have I been pwned?”: https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pra... > The first point I'll make here as I begin talking about the 3 main security constructs available is that they're all differently secure.

Something I feel that's always missed in these discussions is context: Who is the adversary you're attempting to protect against? Your kids screwing around with your phone? TouchID does the job. Random people screwing around with your phone if they find it? Same thing. Government gets ahold of it? Yeah.. notsomuch. Considering that the primary adversaries of an average smartphone user are other mere mortals, not dedicated spy agencies, a fingerprint login strikes a very good balance between usability and…

This article has been discussed in the past (about 2 years ago). https://news.ycombinator.com/item?id=6477505 I think that fingerprints are fine for low security things, but I would never use it as authentication for anything that touches my bank account.