> There is no number of times I can press my finger on your scanner and trick your scanner into thinking I am you.
Or I could print random patterns on gel circles I put on my finger and try until one works, which is the equivalent of your password example. (There are digital equivalents of spamming fingerprint reader values to the security chips, which in practice are faster.)
It's exceedingly easy to try a fake fingerprint, and even if it weren't, it would still be possible to generate fake signals between the sensor and verification chip or fake signals to the sensor. There's no difference here between finger prints and passwords.
> Passwords need to be changed because they can be guessed.
lol, no.
Passwords need to be changed when they're compromised -- a good password is exceedingly hard to guess, to the point we should never expect it to happen, but they can be leaked through other means.
Similarly, you leave you fingerprints everywhere. So you actually leak your fingerprint values constantly while leaking password values only occasionally. This makes passwords substantially more resistant to capturing the value out-of-band than fingerprints.
> we change our passwords regularly,
This isn't best practice and isn't what most of us do; we change our passwords when they become compromised, which happens through a variety of mechanisms. (Or when we suspect that they may be compromised.)
> Bad security advice led to routine password expiration, and that bad security advice lives on. It's still bad.
Everyone knew this was bad, and NIST recently updated their recommendations against routine password expiration. However, that has nothing to do with what we're talking about in terms of username-versus-password status for fingerprints.
> it's clear that fingerprints are closer to username than password
> fingerprints are not a password
Well, I'm glad we agree.
> But TouchID isn't going to be fooled by a piece of scotch tape lifted from your desk, so it doesn't matter.
But it is fooled by easy-to-produce prints placed over my finger based on the Scotch tape lifted from your desk. This has routinely been demonstrated with fingerprint scanners, including on iPhones.
> They are a uniquely identifying attribute.
That's what a username is, lol.
I'm going to recommend you learn more about most of these things before you make security recommendations, because you were factually wrong a few times, and made erroneous conclusions based on that.