If you can't change it or revoke it, then it should not be used for positive security or for identity or authentication. It's the same as if it could change wi

If you can't change it or revoke it, then it should not be used for positive security or for identity or authentication. It's the same as if it could change without any intention on your part. That holds with biometrics too. If I have a new wart on my finger, or maybe a cut or a burn or something, can I still login with my fingerprint? If I'm logging in from a device without a camera, or in a dark place, can I still login with the facial recognition? If I'm under a lot of stress and typing on a bubble keyboard or perhaps a touchscreen, instead of my usual buckling-spring mechanical keyboard in a relaxed setting, will your measurements of typing speed still allow me to login? What if I use a password manager that autotypes the username and password? Any addition like that is another potential point of failure. And if it prevents legitimate use, then it's a bug. However, it does have a place in flagging potentially suspicious activity for review. Banks, at least mine, do a great job of flagging and alerting on suspicious transactions. They've been doing that for many years. Those automated calls that say "Call back at the number printed on your card and press 1 if you authorized all four of the following transactions or 2 if you did not." have a really good success rate in my personal experience. But that doesn't prevent me from buying something or from logging in. Behavioral profiles are useful, but not appropriate for passwords or identities.