Fingerprints and other biometrics can be used as both/either "something you are" and "something you have", if we're using the MFA terminology.
With that in mind, a system that required 2 biometrics for access might be as good as a system that requires 2 factors in other forms.
If someone steals my fingerprint from a glass in a bar, it's unlikely they also have a model of my face or a print of my retina, or some other biometric. Or if they do, it's likely they were motivated enough to also know my password/PIN/whatever.
Putting the tech aspects aside, a biometric is identification and authentication rolled into one: you're both saying who you are and proving it at the same time.
All three factors have different security properties. The big downside of biometric factors is that they can't be replaced when compromised. You can't play language games and say "oh, I technically /have/ fingerprints" and pretend that changes their security properties.
Comments
I don't buy this.
Fingerprints and other biometrics can be used as both/either "something you are" and "something you have", if we're using the MFA terminology.
With that in mind, a system that required 2 biometrics for access might be as good as a system that requires 2 factors in other forms.
If someone steals my fingerprint from a glass in a bar, it's unlikely they also have a model of my face or a print of my retina, or some other biometric. Or if they do, it's likely they were motivated enough to also know my password/PIN/whatever.
Putting the tech aspects aside, a biometric is identification and authentication rolled into one: you're both saying who you are and proving it at the same time.
This is simply untrue, and anyone who follows this advice will fail a NIST audit: https://csrc.nist.gov/glossary/term/multi_factor_authenticat....
All three factors have different security properties. The big downside of biometric factors is that they can't be replaced when compromised. You can't play language games and say "oh, I technically /have/ fingerprints" and pretend that changes their security properties.