Your face is your username, not your password.
Use it like you use your username. But never as something secret, personal, unknown like your password.
The same goes for any biometric. Fingerprints, voice, iris, gait, DNA, etc. No matter how much they try to sell you authentication through biometrics, it's total b.s.
@DustinKirkland
Your face or fingerprint is neither your username nor your password. It's a form of identity. The combination of username and password is another form of identity. A certificate chain is another form of identity. Not all forms of identity are separated into two components like username and password. And different forms of identity have different properties and applicability.
Trying to shoehorn a form of identity like a face or a fingerprint into the username/password template is counterproductive and will only add unnecessary confusion. Please stop. Dumbing down security and removing the nuance is how people get it horribly wrong.
Security is very dependent on context. Authenticating with a phone is very different from authenticating over the internet which is very different from authenticating in a situation where you're physically present with another human being (credit card, bank teller, etc). Authentication schemes need to be designed for the specific use case in which they're used and no rule is universal.
Biometrics are good for unlocking X if the persob who cares about the security of X is the person who oversees the registration of the biometrics.
In this case you are the person and X is ... the phone. That's it, the phone.
You should not be using biometrics-derived data for any passwords except to unlock your phone (or that place with the security guard making sure you registered your face the first time). Because REPLAY ATTACKS.
After that you're supposed to use challenge-response by some auth app on a device. So your fingerprint IS a password for the device but not for external services.
Passwords in general are vulnerable to replay attacks!
My face is not my password, it is my face.
This kind of weak analogy you're trying only weakens the discussion.
In your article you wrote how incredibly easy it is, so why haven't I heard about it happening?
As people age, or are otherwise disfigured, does their username change?