In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this world). I heard quite a few pros and cos of both of them and this got me thinking.

Why do we use password and passphrase at all instead of biometrics? I know biometrics are not the holy grail of authentication and/or identification, but (And the most popular password is... from ZDNET) at least I can be pretty sure that majority of users won't have the very same and easy to guess biometrics. Also I can't forget my finger or iris (while I can forget password / passphrase). With the era of cloud coming, the major strength of passphrases (length) might easly be ephemeral.

Like I said, I know biometrics are not perfect, but if we know that passwords / passphrases are the Achilles' heel of almost every system, why are biometrics underused? According to Tylerl (Biometric authentication in the real world from this site, second answer), biometrics is used even less than it used to be. I mean, even if fingerprints are easily forged, it's still better than having many users with password 123456 or qwertz, at least from my point of view (feel free to prove me wrong).

So, in short, what are the biggest problems / obstacles which are stalling widespread adoption of biometrics?