According to what I've read and heard, multi-factor authentication is supposed to use multiple different types of authentication factors, rather than just different instances of the same kind (e.g. multiple passwords.) One of the most frequently-mentioned types of factors is "something you are," usually biometrics such as your fingerprint, retinal scan, voiceprint, etc.
However, any practical implementation of "something you are" requires that the authentication take place by comparing the user's fingerprint, retina etc. with some sort of known master copy, established beforehand.
Doesn't this, in effect, turn the "something you are" into "something you know," i.e. a shared secret, with all of the vulnerabilities traditionally associated therewith? The fingerprint scan (or whatever it is) can be intercepted, copied, acquired from a compromised server, etc. Admittedly, it's not as vulnerable to social engineering attacks because the user doesn't "know" his or her own fingerprint, at least not in a way that can be used by a third party.
I realize that if the verification process is by computer, then the "something you are" will be converted into "something knowable" (information) at some point. My question: is there a way of doing this that mitigates the vulnerability? I'm thinking of something similar to the way a private key stored on a smart card is effectively "something you have," even though the key itself is still technically information.
I'm not trying to implement such a system, I'm just asking out of curiosity.