Beyond passwords: New tools to identify humans

To me, that seems to suggest that biometrics aren't really passwords (which are private, and authenticate you), so much as they are usernames (which are public, and identify you.)

Just like a username, you can know/have someone else's thumbprint, and "type it in" for the identification phase of login. And just like a username, you need a password in addition, in order to test that you're really who you say you are.

The main difference is that biometrics, unlike usernames, are unique to a person (two people in separate places can't decide to use the same thumbprint without knowing about each-other), so there's no equivalent to trying to log into a machine by using the top 50 most common username+password combinations. In other words, biometrics can always be compromised by HUMINT, and sometimes, given a flawed implementation, by SIGINT--but they're completely immune to MASINT (http://en.wikipedia.org/wiki/Measurement_and_signature_intel...).

Another way to think about it: fingerprints and the like are pretty much UUIDs you're assigned at birth. Just like a textual UUID, anyone who can read it can replicate it or retransmit it fairly easily. There's no security there. What there is, is collision-prevention. Nobody will be using a UUID you just generated unless they're trying to collide with it, specifically. If they just generate their own UUIDs, they'll never pick yours by coincidence. Much easier to detect and flag malicious logins once you can be sure that there's no chance of accidental collisions (e.g., someone just typing in their username-on-some-other-machine that happens to be already owned by someone else on this one.)