Sure, all that's true. But which of those criticisms doesn't also apply to a password or preshared key? Other than size of key-material, but it's a fast enough communication medium that any key less than a megabyte is effectively zero.

I probably don't need to point out how basically every communication on the Internet is based on public key crypto that we don't even think about, but I want to ask how you get your shared key to websites when you visit?
Do you use any tools like signal, telegram and so on?

My point isn't that public key systems are perfect, far from it. It's that it's wrong to say security and usability are contrary to one another.
People who think the public key solution is cumbersome are often comparing "no security" to "ideal security".

For public key to be secure from man in the middle you need a trusted out of band channel or attestation scheme.
For a symmetrical key system you need the same channel.
Without that channel public key has a message interaction where an attacker can swap in their key but is otherwise secure. The symmetric key system is entirely broken.

"Easy case" public key systems are usually a fair bit more secure than a similar level of effort in other schemes, and likewise a given level of security confidence is easier to get to with public key than a password.

Finally, and most importantly: your phone quite likely supports multiple levels of authentication.
You can get into my phone if you have my fingers. This let's you see my calendar, emails and (many) other things. It doesn't let you into all of my files, financial apps, or even device settings.

Nope. Gotta slide afterwards to make the call.

Constitution is mostly nonsense being interpreted by life appointed morons who interpret things however they like.

Bible / Quran, is that you?

Haha, reading some of the responses in this thread actually reminded me of that xkcd but I couldn't immediately find it. Thanks!

Oh wow, things really have gotten bad over there. For me personally, the much greater risk is that I forget my phone somewhere or someone steals it and in that scenario a weak password is the larger issue.

It seems there isn't a single correct answer here. The threat model is different for everyone.

Any weak password at all would have been better in a situation like that.

How?

Have you ever had your phone searched by the police or at the border? I haven't, but I have had someone try to unlock my phone before.

I'd contend most people have a threat model that puts opportunistic access by household members or someone watching them enter their passcode and then snatching the phone and running above border patrol search.

While you can't change your biometrics, walk me through why that matters. I'm not sharing my biometrics outside of the device, and you can't submit them remotely, so if you lift a print off of something it doesn't really get you much without also taking the phone. Once you're there, you're a bit beyond the typical phone thief in terms of threat.

The most common vulnerability is having an absurdly weak password, pin or unlock pattern. For those people biometrics is a vast improvement specifically because it's both secure against likely threats, and it's just as easy as hitting 5 four times in a row.

Every method has trade offs, and there's nothing to gain by pretending otherwise. Likewise, I don't think I would ever say "never use something", except for some contrived examples.

Almost any user are much more likely to encounter a situation where their biometrics are forced and not their password. Passing a border for example.

That's valid only for americans. And even then: how many of them are crossing country borders regularly?

If you point a weapon at me in a way that would compel me to help you unlock my phone with fingerprint or face unlock, I promise you it would not be any harder for you to get me to unlock the device with the pin.

Doubtful. The average thief isn't robbing you at gunpoint. They grab the phone out of your hand and book it.

But even if they did stick around for that, most people use a 4 number pin and that's basically just as easy as face or fingerprint unlock. Its an additional maybe 2 seconds.

If they can force you to put your finger on the sensor they can force you to give them the pin.

It's not just you. There's quite a few people who keep saying this. You'll note that they don't chime in to mention that Norway or Germany.

It's dystopian as fuck that this is where we're at, but I don't think it's a good idea to pretend this is strictly a US thing.

The analogy is perfectly accurate.

An imperfect, simpler form of security vs a higher, more cumbersome form of security.

Where is the problem with that analogy?

Biometrics are not "bad practice for anyone concerned about security". They are one type of security that is sufficient and effective for certain risk profiles but not others. Users should make informed decisions based on their needs and the features of the security implementations they are considering.

Your hyperbole is, in fact, dangerous as it pushes people who do not understand security to blindly accept policies that are not good for their risk profile. We have proof that proper usage of biometrics is more consistent with end-users than proper usage of passwords. It's not just about convenience. It's also about adoption and proper compliance.

Absolutist policies and positions like yours do harm. Just look at how NIST recommendations have moved away from things like frequent password change enforcement because it leads to bad behavior (writing down passwords, etc)