> random subset of ‘memorable word but actually unencrypted password’ This annoys me so much with my bank. Their app lets you enroll your account into Face ID

> random subset of ‘memorable word but actually unencrypted password’ This annoys me so much with my bank. Their app lets you enroll your account into Face ID authentication, then still ask one of the recovery questions every time. The UX is awful. I'm so convinced that complaining anywhere won't actually help so I don't bother. I'd love to know what the hypothetical attack scenario is that drove that decision, but I suspect there isn't one, and the app saves the username/password in encrypted device storage.