The problem with biometrics and the like is that you can always capture the data somewhere along the way and then fake a client to imitate it. So if your passwordish thing gets compromised, your account can be compromised.
And once that happens, you can't change a password that is your face.
And once that happens, you can't change a password that is your face.