I would never use this for anything sensitive.
Bad actors can get your face and your fingerprint. Some of them already have it (governments, banks, Apple, Facebook, etc). And changing your face or fingerprint is practically impossible.
Bad actors can get your face and your fingerprint. Some of them already have it (governments, banks, Apple, Facebook, etc). And changing your face or fingerprint is practically impossible.
1. Have access to your phone
2. Be able to spoof the phone's authentication mechanisms (whether that be fingerprint / face)
In this regard, it passes the 2FA test (something that you own, and something that you are).
While it's true that you can't really change your face or fingerprint, this facilitates moving away from the "password repeated across multiple accounts" landscape of insecurity.
From an epistemological point of view: I don't know if they have it.
From a security point of view: they have your fingerprint.
Ultimately you do have to trust your platform if you're going to use a platform authenticator to some degree.
But the alternative in the FIDO2/webauthn space is something like a Yubikey which has no biometrics; it just takes a simple tap. And can be easily removed from your computer. So in that comparison, the fingerprint is purely additive security. Even if it's adding nothing to a serious adversary, it's still dramatically reducing risk to a less-skilled local attacker.
FaceID and TouchID both record any data they need in parts of the enclave that can't be used for anything else, and cannot be extracted. The information that they do store is not a picture, and cannot be reversed even in the case where someone does manage to get that data.
They have repeatedly documented how these features work.
Similarly touchid and faceid aren't sending your touchid/faceid data to a third party (because again, even if they wanted to, they can't), they're simply gating access to credential data on successful local authentication.