> A password requires your action to provide. But it's easy to trick the user. Very easy. And because passwords tend to be difficult to use, users tend to pick

> A password requires your action to provide. But it's easy to trick the user. Very easy. And because passwords tend to be difficult to use, users tend to pick easy ones, such that you don't need to trick the user at all. With bio, the user may opt to have the protection whereas with password they either may not, or it may be trivially bypassed. Bio systems can be engineered to be anti-phishing, anti-MITM, etc. Incredibly hard to do that with passwords. By claiming that the user has to do something to use a password ignores the vast, vast set of vulnerabilities involved. One is not really better than the other per se. It's very use case dependent and you optimize for a specific outcome based on the risks at hand. You won't perfectly get every possibility nailed.