This article was and remains wrong, and at least in the comments so far most people appear to be missing the point, which in turn weakens security. Biometrics a

This article was and remains wrong, and at least in the comments so far most people appear to be missing the point, which in turn weakens security. Biometrics are neither user names nor passwords, they're a perfectly valid factor (along with something you know and something you have) with their own strengths and weaknesses vs various threat models. One of the most absolutely fundamental mistakes that can be made with security is sacrificing the good at the alter of the perfect, because overall security is always, 100% of the time an economic equation, a time/resource expenditure tradeoff between an attacker and defender for a given value of information. "Security" as a field also exists almost exclusively for the benefit of and requiring interaction with humans, which means that the human factor must always be a fundamental consideration as well. Or more pithily, a "security" system is garbage if its users can't use it, won't use it, find it too easy to screw up, or even if the costs it imposes are greater then the benefits provided. Biometrics, including finger prints, are human friendly, and that instantly makes them worthy of consideration as part of a system. Touch ID or the like can enable a person to use an extremely strong password that would otherwise be completely uneconomic, and the combination of a limited time, extremely fast biometric shortcut with a very strong core password, particularly if combined with coercion code use (only possible for now via jailbreak but something Apple or another manufacturer could and should implement at all levels), remote lockout (long available everywhere), etc., may be significantly better then merely a PIN code alone. Threat models cannot be ignored for a security system, because they define the system. The greatest threat most people face are remote attacks, with the next greatest being scatter shots of various sorts (in other words, somebody was looking to steal or attack a device, not your device in particular). Persistent targeted threats are an entirely different situation and a password alone is not even necessarily better in a mobile scenario, because in a mobile scenario you often do not have even a modicum of control over your environment. A fingerprint might be possible to lift and use as the author links, but a PIN code or password can be taken, often even more easily, via shoulder surfing or cameras. In fact in the modern first world environment bird's eye view (ceiling/pole-mounted etc) surveillance cameras are becoming ever more ubiquitous and ever higher resolution. Are people going to seriously suggest nobody use their mobile device anywhere with a surveillance system? More and more, how will you even know that? Taking advantage of the ever increasing cost/performance/size/power improvements powered by the smartphone revolution, retailers are interested in ever more camera use not for thieves but for metrics, to figure out exactly what shoppers are doing down to precisely what they're looking at and for how long. The retailers of course have no interest in your phone info, and in fact an interest in not making people worried about that sort of thing. But if we're going to consider someone going to the specific trouble to rapidly spoof biometric identity for a specific device, then it's necessary to consider that once the cameras exist at all access for non-intended purposes may be just a hack or national-security-directive away. Basically, it's frustrating to still see people pointing to "somebody broke into this security system!" as if it means anything without thinking about the time/resource cost and threat model. Biometrics absolutely have a role to play in general authentication for the general population for the foreseeable future. There are paths for improvement there just as in other areas, perhaps culminating in fusion technologies like security authentication implants wired into our brains someday, but we'll need functional authentication to get us that far and passwords alone do not cut for most of the population as currently implemented.