I've read somewhere (probably in one of Troy Hunt's posts) that biometric data should not the be password, but rather the username. Maybe we're looking at this the wrong way. Biometric data seams to be equivalent (or at least similar) to a public key.