This is a little TechCrunch article about the new methods of authentication that do not require a password. BitWarden - a competitor to LastPass and 1Password - has acquired a startup called Passwordless, and is going to be integrating this into their products.
The reason I chose this article to link to, is because it has links out to several other good articles that describe how authentication works in these new environments, who is backing which technologies, and is basically a great primer on the question, "what comes after passwords?"
Who has thoughts on this? Let's talk about this area of development...
Ethereum solved this problem the minute Metamask built their first browser extension. Not mentioned in the article, or any of the linked articles, or any of the linked articles' friends, is the essential business need to silo the shit out of everything and keep it locked away so that you can only use it within their ecosystem. That was the whole push behind "sign in with Facebook" and, therefore, 'sign in with Google" - keep you locked away from the open web and inside a containerized, monetized channel where everything is safe and everything is beautiful. It's Apple's walled garden but stupid. This is why i use 1password and why I pay for everyone in the office to do the same - it's 128-bit encrypted with the secret key entirely in your possession. Take away the passwords and leave the extension and you're pretty much what you can do with blockchain. No. Fuck off. Eat shit and die. The amount of leaky biometric bullshit we're already dealing with is horrific - Android Marketplace in particular gives no fux if an app that doesn't need it totally grabs the fingerprint sensor. The whole problem is I should need one password but every website and every app disagrees as to how I should give it to them. Blockchain fixes this and has done since browser wallets.From today, Bitwarden has launched a new beta service called Passwordless.dev by Bitwarden, which allows any third-party developer to embed biometric sign-in technology such as Touch ID, Face ID and Windows Hello into their apps.
Biometric data is still relatively unused for identification, but is increasing. Think how absolutely fucked you are in the near future, once your actual physical corporeal identity (not just some online persona) has been hijacked. Like 100% completely fucked because how would you claw it back? Change your DNA or eye pattern or fingerprints or pheromone/sweat composition or whatever is chosen to tag someone as you in the future.
I could see my heath care provider having a validated sample of my biometric data, and being able to validate my corporeal self to an entity that needed to confirm my identity vs an imposter. The imposter wouldn't have access to my blood, or whatever, so validating should be possible.
I hear ya, but this is not falsifiable data. Yeah, a scammer gets ahold of the digital hash that represents my Blood ID (or whatever) from a poorly secured database, but I'm the only one that has the ACTUAL BLOOD. So I can always confirm my identity with absolute certainty in case of theft or impersonation... a thief is only going to have the computer hash, not my actual blood. (Or retinal scan, or whatever bio data is being used to establish my identity.) Of course, some people donate blood or sperm or organs or whatever, and there could be an issue with security there. But that's not a concern for 99% of the population, while shitty passwords are literally a problem for everyone in the world.
You can compare a data point to another datapoint, you mean. Android fingerprint readers don't hash your fingerprint. they upload your fucking fingerprint to Amazon. So when a fraudster uses your fingerprint, and you say "nope, that's not my fingerprint, this is my fingerprint", the banks go "same fingerprint d00d." So now your fingerprint is FOREVER out there and you can't use it to validate ever again because it's a stolen credit card number. So maybe someone grabs Goobster's fingerprint data and the first thing he does is go "huh I'll bet I can use this to score some identities." He goes around with a forged birth certificate and heads to the DMV and says "I need a driver's license, oh by the way my fingerprints were stolen." So now they WON'T USE HIS FINGERPRINT to verify his identity, they'll fall back on their ancient bullshit. Meanwhile, all the speed he's encountering in using your identity to steal your life is slowing you up because while neither one of you can be trusted? He's used to this. You know what's cool about credentials? They can be revoked. You know what sucks about biometrics? They can't. Mistakes are made, accidental and deliberate, and expecting a company that shows absolutely no interest in protecting your revocable credentials to treat you irrevocable credentials any differently is naive in the extreme. Meanwhile you've just created a situation where in order to rent a car I now need to get Theranos involved or some shit which, frankly, no thanks. Nexus passes between the US and Canada have iris scans for Canadians. They don't for Americans, in no small part because customs and border protection in the US didn't want to be responsible for a bunch of indelible biometric data. They know "information wants to be free." I'm sure they'll change their mind eventually - Dipshits have been pushing for this since before Sony rootkitted their compact discs. But that doesn't make it a good idea. Shitty passwords are a design choice. They are the outcome of a bad system imposing unrealistic demands on its users. The solution is not to make the users try harder, it's to make the system better. If you need more security than I can provide easily, you can fuck right off. There's nothing you're doing for me that can't be done with less. Prove me wrong.
The issue for me is that you can't invalidate or change it once your biometric data is out there, which it definitely will be. I don't think imposters will need access to your blood, just the data about it. That will be enough to cause real damage I think. You seem pretty chipper on the idea but I'm less optimistic. Firstly about even having those concerns but then also having to actually deal with the fallout once your biometric data is in the hands of some Belgian drug gang. Like take a detached step back and re-read what you've written there. What you've described is a chilling prospect to me.
At some point, we're going to need legislation that says "no, Facebook, fuck off, you are NOT entitled to know that much about me." I'm pessimistically certain it will be after some bullshit "move fast and break things" tech company with a fuckton of VC money behind it builds a security stack out of eggo waffles and karo syrup and gets plundered by Russian hackers to the tune of a million fingerprints.
Biometric data is just another identifier, like a SSN, driver's license, name, whatever. Because it is harder to gather right now does not make it any different than any other identification method. All the same security concerns apply. Regardless of whether the imposter has my social security number or the digital hash of my blood's fingerprint, it's just data. And that data can be validated or invalidated through more stringent testing methods; like running another blood test and validating I am who I say I am. No scammer has access to my blood, so I'll always be able to prove I am me.
I'ma go get a new driver's license. You go get new fingerprints. We'll circle back and compare our tasks, deal? "Aha!" you're tempted to say. "But I can always prove who I am because I have the original fingerprints!" Sure. But you're going to verify your fingerprints by going "look this is my birth certificate I'm really me and THESE are my fingerprints" and so is the guy who is stealing your fingerprints and because he's aware he's doing it and you're still catching up, lo and behold, you are no longer you. In a normal situation when you've been subjected to identity fraud, you erase the defrauded shit and start over. In a situation where the fraud involves biometrics, there will forever be an asterisk next to your data. You're going to take longer to get on a plane, you're going to be held up by medical insurance, your bank loans are going to be subject to additional scrutiny, all of it. It'll be the same as the credit bureaus do to you NOW except they'll say "we use biometrics we're perfect" and it'll be ten years of brown people bitching about how that is very much not the case before a single white person gives a shit.