[rdl]

The phone iPhone passcode thing is kind of a joke, unfortunately -- it's fairly easy to extract the encrypted image from a locked phone, then brute force it. Since almost everyone just uses a 4-digit simple PIN, doing an exhaustive search is faster than syncing to iTunes.

What I'd really like is TPM-type security built into the phone (and used correctly) to protect from brute forcing a short authentication code, and maybe multi-factor auth. e.g. if the phone is inside my house or office (was on my secured wifi, hasn't moved), there can be less security (longer relock interval, shorter passcode, etc.) than if I am out and about. If there were a way to definitively link my phone to my car, I'd be fine with turning off all passcodes -- maybe due to bluetooth pairing or something.

Biometrics might actually make sense in phones, too, although I'm not sure how much I like the facial recognition in ice cream sandwich.

[gte910h]

You're allowed to use a password instead of a 4 digit passcode if you want.

Biometrics are evil. If someone wants what's in your phone that bad, you don't want them cutting off your thumb to get it.

[rdl]

I do, but typing in a long passphrase every single time you unlock your phone kind of sucks; if I had a 4 digit passcode I might set a shorter relock interval.

I'm not so afraid of someone's stealing my phone, then coming back and cutting off my thumb. If I were using the phone, it'd be easier to come up at gunpoint and grab the phone while it's unlocked, if you're that paranoid (one of the reasons highly sensitive data isn't unlocked "in the wild" in sensitive organizations).

Simple theft or losing the phone is still the most likely, and a biometric+PIN, securely stored on device, solves this.

High-end luxury cars have great engine immobilizer systems, which led to a lot of carjackings, since it was easier than unattended theft, which is basically the problem you've identified.

There are LOTS of other issues with biometrics, but they mainly come up when they're part of a centralized service and can't be completely controlled by the user.