> but I feel like this is just a password you can't change Not quite. IBM has (had?) a research program on "cancelable" biometrics. I do not recall perfectly,

> but I feel like this is just a password you can't change Not quite. IBM has (had?) a research program on "cancelable" biometrics. I do not recall perfectly, but I think they were tweaking the encoded biometric sensor data before committing it to DBs. If there is a leak, one can redo it with a new tweak (like a new salt or nonce).