Convenient Biometric Authentication

XKCD, Passwords

Consider this in the context of convenient biometric authentication like TouchID and FaceID.

Imagine you travelled to the US with a locked briefcase that contained every text message, email, and private message you’d ever sent to a loved one. It also included every web search you’d ever conducted, and — through your bank account and PayPal records — every purchase you’d ever made and every organization you’d ever donated money to.

The customs agent not only wants to open your locked briefcase —he also wants to copy all of its contents and store them forever in a database, which will be shared with all manner of law enforcement agencies and tax agencies, and will eventually be available to anyone working in any capacity in the government without the need for a warrant.

All your data will be stored in a database built by the lowest bidder — the same kinds of government contractors who brought you Healthcare.gov and the aborted $208 million California DMV database. It will be so valuable that all manner of malicious hackers will materialize from out of the woodwork to try and steal it.
That is what makes your locked phone different from a briefcase with a few personal details locked inside it.

Author: Khürt Williams

A human who works in information security and enjoys photography, Formula 1 and craft ale.