[zeta0134]

This is part of the reason Windows Hello won't use standard webcams for facial recognition. They require a depth camera (very unusual feature on laptops, usually marketed as Intel Real Sense) so that a simple photograph isn't enough to fool the camera.

This is still far from perfect though; a truly determined bad actor could create a passable 3D model, or even a face mask, and probably still fool the sensor. It just takes more work. The whole point of passwords is that no one can know them but the person intending to use them. Using a publicly visible part of my body is just asking for trouble.