Soon enough computers will be able to check every possibility for passwords as big as we can remember them. With good algorithms predicting what is likely to be a valid password, maybe they already can.
Even though I agree fingerprints aren't a good solution, passwords aren't either. Any ideas?
Maybe we could have some kind of card that would have big keys stored on it.
EDIT: Fixed missing word
I do this on a regular basis because I have an entire sentence as my LastPass passphrase.
Usually.
I should never become a spy, my security technique is laughable.
You could probably make a list of 256 common, short words that are distinguished by their first two letters[1], but to encode 128 bits of entropy, you'd need 19 words, (or 16 if you managed to get use 512 words). Even if you picked only the first two letters, that's best case 32 characters. It's a lot to type blind, it's a lot to remember, it's complicated to cycle the phrase.
So it's better to not have to remember the password - use a password manager. Or, if you could somehow avoid the possibility of off-line attack, and guarantee solid rate-limiting -- much less entropy might be needed. A 4-digit pin is probably on the low side (consider that on a site with ~100.000 users, if you tried any set of three pins, you'd probably compromise many accounts, assuming uniform distribution of pins).
Another way, is to continue using a shared secret, but prove knowledge in a different way: eg using TOTP[2]. On the other hand, TOTP shares some of the disadvantages of unsalted passwords: the secrets are stored in plain text both on your one-time token generator (your insecure smartphone), and on the server. On the other hand, they're harder for most users to re-use than passwords are (users typically don't know the secret used to generate one-time passwords).
But all these have another problem: how to you protect your secrets? You could use full disk encryption... protected by ... a password?
Still, the idea of using a fingerprint for authentication, especially on a device filled with your fingerprints seems like a pretty bad idea. Never mind the fact that once compromised they can never be changed.
As for your last point, I do think the combination of something like a yubikey neo[3] along with NFC is probably the sweetspot for practical security right now. You can use it to unlock your smartphone, and your computer.
[1] (26^2=512, but not all combinations are common, fitting 256 should probably be possible, even if the more common combination of vowel+consonant is only ~6*20=120. Possibly in combinations with the numbers 1..99)
[2] https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...
[3] https://www.yubico.com/products/yubikey-hardware/yubikey-neo...