> fingerprints have the unfortunate property of not being rotatable if compromised

Coworker has a wonderful term for this. He calls fingertips "amputationware". It really drives the point home.

But there is another very good reason to avoid fingerprints auth methods. The scanners are by design doing some level of fuzzy matching, so if/when[0] someone finds a way to generate an input that reproduces the signal pattern from the reader well enough, it can be fooled. (Yep, done already.)

My personal take on fingerprint authentication is that they are not passwords. They are usernames.

0: http://engineering.nyu.edu/press-releases/2017/04/10/so-you-...