I do not understand why any security concerned person would use biometric identification for anything, ever.
Security is all about threat models, and I can imagine quite a few scenarios where biometrics might fare better than passwords. Shoulder surfing and trivial passwords/PINs come to mind, for example.
And who said that it's biometrics vs. anything else? It's quite advisable to combine authentication factors.
But this article is about a system for giving up passwords under duress without necessarily compromising all your security, such that your antagonist has no way of knowing or showing that there's another password concealing more important information.
If “those guys” are your adversary, you were fucked before you started.
Complying in the face of threats of physical violence is equivalent to "being easily swayed"?
You seem to have a pretty specific threat/defense model that you didn't clarify. I wouldn't generalize from that to "biometrics are bad for all users in all situations".
What I'm saying is that if such threats are unacceptable to a person, chances are they are not going to involve themselves in the sort of activities that require keeping secrets in the first place, or are sufficiently disciplined to have weak device security because they don't write anything down.
How, exactly? And "require users to watch out for shoulder surfing and use strong passwords" does not count.
Any chance you are thinking about pretty specific circumstances here (security-aware, technical employees generally not having to enter passwords in public spaces)?
Face ID: https://support.apple.com/en-us/HT208109
Fingerprint Readers: https://www.samsung.com/us/support/answer/ANS00082563/
These are extant, and either part of or required within numerous presently-used systems.
I've a device (Onyx BOOX) which apparently can only be password-secured if I create a vendor-based account on it. (I've been trying to see if this is bypassable, so far, no dice.) That's not biometrics, but it's a case of being strongly limited by a system architecture.
If you're using a device at the obligation of an employer, you may well find that it has, and/or organisational policy requires, biometrics.
It's increasingly difficult to find devices that don't include some form of biometrics-based functionality. The notion that that becomes the primary or only means of securing access is not entirely far-fetched.
Capabilities, possibilities, and dependencies have a really funny way of becoming hard requirements over time.
I could speak the Celtic of my ancient ancestors or communicate in cuneiform or ancient Egyptian hyroglyphics, if really wanted to. My ability to integrate and participate in modern life would be quite limited. The online and digital world are rapidly approaching this state.