Why is a biometric characteristic a weaker basis for authentication than it looks, and how should it be used?

A biometric is not a secret, cannot be replaced once compromised, and only matches with a probability; it should therefore only be used together with a physical authenticator, typically to unlock a key on the subject's own device.

• Not secret: you leave fingerprints on every glass and show your face in every photo. An attacker can capture the characteristic and build a replica (a gummy finger, a photo or mask), a presentation attack.
• Not revocable: a leaked password is changed in a minute; a leaked fingerprint template is compromised for life, and you have only ten fingers.
• Probabilistic: false matches are possible, so an attacker can sometimes succeed with a similar-enough sample.
• Sensitive data: biometric data is especially protected personal data, so central template databases create privacy and breach risks.

NIST SP 800-63B therefore says a biometric is not an authenticator by itself. It may only be used in combination with a physical authenticator ("something you have"), it must limit failed attempts (5 consecutive failures, or 10 with presentation attack detection), and a non-biometric alternative must always be offered. The common good pattern is local matching on the device: the fingerprint unlocks a private key in secure hardware, and only a signature leaves the device, never the biometric.

Go deeper:

• NIST SP 800-63B-4: Use of biometrics — the normative limits on biometric use, attempts and alternatives.
• Biometrics: Presentation attacks (Wikipedia) — spoofing with replicas and the countermeasures.