[jrm4]

Correct. I'm not saying he's wrong, I'm saying he's irresponsible.

I absolutely want any so-called security expert to always also include the big picture or shut up forever. There's too much confusion and too at stake for people as big as him to isolate personal security from big picture privacy.

[PeterisP]

I believe that Troy is quite clearly including the big picture, but his assumptions about it may be different than yours - in particular, he's effectively making a point that in the big picture defense from competent adversaries there is no major difference between passwords and biometrics (by providing examples where trying to rely on passwords doesn't help much) and thus discussing those attacks simply isn't relevant for a discussion on "biometrics vs passwords for the common person"; it would be worthwhile to discuss the weakness of biometrics to e.g. state-level actors if and only if the alternative (pin-codes/passwords) is meaningfully different in that regard, and IMHO it isn't as a resourced attacker can e.g. unlock phones without owner's cooperation no matter if you're using a fingerprint or a passcode.