Biometrics are good as usernames, not passwords. There just isn't sufficient entropy. And until we can resleeve a la Altered Carbon, you only have one body. @Apple products are in a race to be the least secure devices available.
techcrunch.com/2018/12/16/3d-…
techcrunch.com/2018/12/16/3d-…
To be clear. My comment on Apple is that they keep doubling down on biometrics rather than supporting stronger forms of auth, like U2F. Better biometrics are still bad security imo.
Apple itself has warned against using your face as a password. It’s much less effective if you’re under 13 (underdeveloped features), darker skinned (lost entropy via contrast), and prior implementations have been broken by photos and masks.
Biometrics are fine as a second factor to make systems more secure. Or they can be used for low security situations. But Apple really should make stronger forms of auth an option to users. Unfortunately due to their closed system bias, to date they haven’t.
Large scale attacks that subvert traditional 2fa exist in the wild today. And not supporting U2F / FIDO2 is simply putting users at risk :
