I said this in a previous thread [1], but I'll restate here: Your face or fingerprint is neither your username nor your password. It's a form of identity. The

I said this in a previous thread [1], but I'll restate here: Your face or fingerprint is neither your username nor your password. It's a form of identity. The combination of username and password is another form of identity. A certificate chain is another form of identity. Not all forms of identity are separated into two components like username and password. And different forms of identity have different properties and applicability. Trying to shoehorn a form of identity like a face or a fingerprint into the username/password template is counterproductive and will only add unnecessary confusion. Please stop. Dumbing down security and removing the nuance is how people get it horribly wrong. Security is very dependent on context. Authenticating with a phone is very different from authenticating over the internet which is very different from authenticating in a situation where you're physically present with another human being (credit card, bank teller, etc). Authentication schemes need to be designed for the specific use case in which they're used and no rule is universal. [1] https://news.ycombinator.com/item?id=15233454 https://news.ycombinator.com/item?id=15233454