Well, in most cases there are nine other digits you can use. That's probably a r...

jrockway · on Jan 18, 2013

I change my password more than 9 times a year, and I plan to live for more than one year.

bonaldi · on Jan 19, 2013

That's not IT issuing you a new password, that's you changing it. The point is that biometrics are perfectly feasible as one of the two factors (instead of something you know) and can still be revoked.

jrockway · on Jan 19, 2013

I also don't leave my password on everything I touch.

Biometrics are a terrible idea. Password + token is much safer and infinitely revokable. And the server can even tell when an HOTP device has been cloned.

SoftwareMaven · on Jan 19, 2013

That, and not the revocability, is the core of the problem. It also comes back to a foundation of security: something you have and something you know.

Personally, I think most biometrics are bunk, unless you use multiple (fingerprint, iris, etc) along with some kind of password.