&gt; [Fingerprints] are just hard to reproduce.<p>I think this is the key point. If fingerprints were like public-key authentication mechanisms, they&#x27;d be fantastic. If it was mathematically impossible or even just very difficult to fake them just by intercepting previous authentications, that would be incredibly useful.<p>That&#x27;s not the case though.<p>They&#x27;re easily reproduced in moments using putty[0] or play-doh[1]. Or duplicated using household materials, even from a fingerprint collected from the targeted iOS device itself.[2] Some teams have found difficulty using some of these methods against a MS fingerprint scanner, but still found success using a toy wax kit from Crayola.[3]<p>But the general point about revocation is this: you should imagine, whenever designing a security system, &quot;what&#x27;s my fallback when this fails?&quot; Biometrics can fail for lots of reasons, not only due to adversaries.[4] You need to have some idea of how to recover from those failures beyond just insisting that those failures don&#x27;t happen or are unlikely.<p>Revocation is a handy fallback in those situations for a lot of systems. It&#x27;s so common that people probably wrongfully assume it&#x27;s the only way to recover. Fingerprints can&#x27;t offer revocation, but they may have other fallbacks. Maybe you have a guard checking photo IDs if a scanner doesn&#x27;t work for entry to a facility.<p>Scanners for devices might need to simply fail to require usernames and passwords for some users after they&#x27;ve been compromised. That could still offer convenience for other users, but over time, fewer and fewer users would get that benefit.<p>Or maybe fingerprints are just not designed to be that secure, and maybe that&#x27;s ok. Anyone can get through the standard household locks in seconds with about 30 minutes max of research on youtube. They&#x27;re not perfect security and not intended to be, they just put a small barrier (mostly social) to prevent the most nuisance level entries.[5]<p>[0] <a href="http:&#x2F;&#x2F;www.puttyworld.com&#x2F;thinputdeffi.html" rel="nofollow">http:&#x2F;&#x2F;www.puttyworld.com&#x2F;thinputdeffi.html</a><p>[1] <a href="https:&#x2F;&#x2F;secure.marketwatch.com&#x2F;story&#x2F;this-company-hacked-an-iphone-with-play-doh-2016-02-26" rel="nofollow">https:&#x2F;&#x2F;secure.marketwatch.com&#x2F;story&#x2F;this-company-hacked-an-...</a><p>[2] <a href="http:&#x2F;&#x2F;dasalte.ccc.de&#x2F;biometrie&#x2F;fingerabdruck_kopieren.en" rel="nofollow">http:&#x2F;&#x2F;dasalte.ccc.de&#x2F;biometrie&#x2F;fingerabdruck_kopieren.en</a><p>[3] <a href="http:&#x2F;&#x2F;www2.washjeff.edu&#x2F;users&#x2F;ahollandminkley&#x2F;Biometric&#x2F;index.html" rel="nofollow">http:&#x2F;&#x2F;www2.washjeff.edu&#x2F;users&#x2F;ahollandminkley&#x2F;Biometric&#x2F;ind...</a><p>[4] See Yager and Dunstone on the Biometric Menagerie for an interesting classification system for the wide variety of failure cases you have to tune any biometric system against.<p>[5] If you want more about this philosophy &#x2F; interpretation of locks and security, or even if you don&#x27;t, there are fewer better ways to spend an hour than by listening to the brilliant Schuyler Towne at RVAsec on the history and social function of locks and lock-making. No seriously, it&#x27;s amazing. <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=3nROJz_UNQY" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=3nROJz_UNQY</a><p>EDIT: moderated my views in the last two paras, sorry for any whiplash.