[cassianoleal]

I don't buy this.

Fingerprints and other biometrics can be used as both/either "something you are" and "something you have", if we're using the MFA terminology.

With that in mind, a system that required 2 biometrics for access might be as good as a system that requires 2 factors in other forms.

If someone steals my fingerprint from a glass in a bar, it's unlikely they also have a model of my face or a print of my retina, or some other biometric. Or if they do, it's likely they were motivated enough to also know my password/PIN/whatever.

Putting the tech aspects aside, a biometric is identification and authentication rolled into one: you're both saying who you are and proving it at the same time.

[tiberious726]

This is simply untrue, and anyone who follows this advice will fail a NIST audit: https://csrc.nist.gov/glossary/term/multi_factor_authenticat....

All three factors have different security properties. The big downside of biometric factors is that they can't be replaced when compromised. You can't play language games and say "oh, I technically /have/ fingerprints" and pretend that changes their security properties.