False Sense of Security

It is very worrying to see so many ICT people being indifferent to the difference between AND/conjunction and OR/disjunction when talking about “two factors used together”.

Biometrics can theoretically be operated together with passwords in two ways, 

(1) by AND/conjunction or (2) by OR/disjunction.  Biometric products operated by (1) are unknown.  The users of such products must have been notified that, when falsely rejected by the biometric sensors with the devices finally locked, they would have to see the devices reset.　 It is the same with the biometrics operated without passwords altogether.

Biometric products like Apple's Touch ID are generally operated by (2) so that users can unlock the devices by passwords when falsely rejected by the biometric sensors.  This means that the overall vulnerability of the product is the sum of the vulnerability of biometrics (x) and that of a password (y).  The sum (x + y - xy) is necessarily larger than the vulnerability of a password (y), say, the devices with Touch ID and other biometric sensors are less secure than the devices protected only by the password.

What makes us nervous is the possibility of seeing such pictures that many of the consumers, who are trapped in the false sense of security, are piling up their assets and privacy in the cyber space while some of the criminal wolves, who are aware that those consumers are now less safe, are silently waiting for the pig to grow fat.

I would appreciate to hear different views, especially from the people who are professionally engaged in biometrics industries.