I could see my heath care provider having a validated sample of my biometric data, and being able to validate my corporeal self to an entity that needed to confirm my identity vs an imposter. The imposter wouldn't have access to my blood, or whatever, so validating should be possible.
I hear ya, but this is not falsifiable data. Yeah, a scammer gets ahold of the digital hash that represents my Blood ID (or whatever) from a poorly secured database, but I'm the only one that has the ACTUAL BLOOD. So I can always confirm my identity with absolute certainty in case of theft or impersonation... a thief is only going to have the computer hash, not my actual blood. (Or retinal scan, or whatever bio data is being used to establish my identity.) Of course, some people donate blood or sperm or organs or whatever, and there could be an issue with security there. But that's not a concern for 99% of the population, while shitty passwords are literally a problem for everyone in the world.
You can compare a data point to another datapoint, you mean. Android fingerprint readers don't hash your fingerprint. they upload your fucking fingerprint to Amazon. So when a fraudster uses your fingerprint, and you say "nope, that's not my fingerprint, this is my fingerprint", the banks go "same fingerprint d00d." So now your fingerprint is FOREVER out there and you can't use it to validate ever again because it's a stolen credit card number. So maybe someone grabs Goobster's fingerprint data and the first thing he does is go "huh I'll bet I can use this to score some identities." He goes around with a forged birth certificate and heads to the DMV and says "I need a driver's license, oh by the way my fingerprints were stolen." So now they WON'T USE HIS FINGERPRINT to verify his identity, they'll fall back on their ancient bullshit. Meanwhile, all the speed he's encountering in using your identity to steal your life is slowing you up because while neither one of you can be trusted? He's used to this. You know what's cool about credentials? They can be revoked. You know what sucks about biometrics? They can't. Mistakes are made, accidental and deliberate, and expecting a company that shows absolutely no interest in protecting your revocable credentials to treat you irrevocable credentials any differently is naive in the extreme. Meanwhile you've just created a situation where in order to rent a car I now need to get Theranos involved or some shit which, frankly, no thanks. Nexus passes between the US and Canada have iris scans for Canadians. They don't for Americans, in no small part because customs and border protection in the US didn't want to be responsible for a bunch of indelible biometric data. They know "information wants to be free." I'm sure they'll change their mind eventually - Dipshits have been pushing for this since before Sony rootkitted their compact discs. But that doesn't make it a good idea. Shitty passwords are a design choice. They are the outcome of a bad system imposing unrealistic demands on its users. The solution is not to make the users try harder, it's to make the system better. If you need more security than I can provide easily, you can fuck right off. There's nothing you're doing for me that can't be done with less. Prove me wrong.
The issue for me is that you can't invalidate or change it once your biometric data is out there, which it definitely will be. I don't think imposters will need access to your blood, just the data about it. That will be enough to cause real damage I think. You seem pretty chipper on the idea but I'm less optimistic. Firstly about even having those concerns but then also having to actually deal with the fallout once your biometric data is in the hands of some Belgian drug gang. Like take a detached step back and re-read what you've written there. What you've described is a chilling prospect to me.
At some point, we're going to need legislation that says "no, Facebook, fuck off, you are NOT entitled to know that much about me." I'm pessimistically certain it will be after some bullshit "move fast and break things" tech company with a fuckton of VC money behind it builds a security stack out of eggo waffles and karo syrup and gets plundered by Russian hackers to the tune of a million fingerprints.
Biometric data is just another identifier, like a SSN, driver's license, name, whatever. Because it is harder to gather right now does not make it any different than any other identification method. All the same security concerns apply. Regardless of whether the imposter has my social security number or the digital hash of my blood's fingerprint, it's just data. And that data can be validated or invalidated through more stringent testing methods; like running another blood test and validating I am who I say I am. No scammer has access to my blood, so I'll always be able to prove I am me.
I'ma go get a new driver's license. You go get new fingerprints. We'll circle back and compare our tasks, deal? "Aha!" you're tempted to say. "But I can always prove who I am because I have the original fingerprints!" Sure. But you're going to verify your fingerprints by going "look this is my birth certificate I'm really me and THESE are my fingerprints" and so is the guy who is stealing your fingerprints and because he's aware he's doing it and you're still catching up, lo and behold, you are no longer you. In a normal situation when you've been subjected to identity fraud, you erase the defrauded shit and start over. In a situation where the fraud involves biometrics, there will forever be an asterisk next to your data. You're going to take longer to get on a plane, you're going to be held up by medical insurance, your bank loans are going to be subject to additional scrutiny, all of it. It'll be the same as the credit bureaus do to you NOW except they'll say "we use biometrics we're perfect" and it'll be ten years of brown people bitching about how that is very much not the case before a single white person gives a shit.