[konceptz]

We should understand the attack model better and the likelihood of a successful eye capture.

We know that it's certainly less hard than knowing someone's password given a semi sane password policy, but more difficult than scraping fb selfies and printing them.

Thinking out loud, I certainly don't share my phone password with my eye doctor, so there's one example of disclosure.