system
Given the following post, respond as if you're commenting on Reddit:
human
How is biometric authentication not practically the same as using the same password for everything?

Sure it is a good password so it can't practically be guessed, but in the event of a database leak with all our fingerprints they are no longer secure and can no longer be used, ever really.
gpt
Biometrics, although intended as an authentication method, are significantly different than passwords.

1. Biometrics can be forged - forging a password means you know it
2. #1 is because a biometric is _something you have_, while a password is _something you know_. Ideally one would use them together in a 2-factor authentication system
3. Passwords are secret data. Algorithms can manipulate (secret) data to realise useful security properties like confidentiality and authentication. However, passwords are intended to be remembered by humans, severely compromising their entropy, and thus their usefulness to said algorithms
4. Biometrics are _measures_ of the human body, and thus are susceptible to measurement errors. Additionally, they are not secret, aka _confidential_; you show your retina to everyone you meet every day, your fingerprints are all over your desk, the cafeteria, the bottle you just picked up, etc.
5. To satisfy the property that a biometric must authenticate a person in the face of measurement errors, it must be suitably _unique_. Corollary is, of course, that you aren't able to change it often, or at all.

In a general context, you are thus correct: since a biometric represents something you have, and you can't alter it very easily (although that's the very thing cosmetic surgery is fighting against), it would be equivalent to using the same password for every purpose. This goes against the general guideline that instruct us to not use the same password for multiple services, because that leads to a centralised failure mode: if one of these services is compromised, your account in all the rest is also compromised.

Biometrics work better in local contexts. A _local context_ is where there is an available "honest" system; no men-in-the-middle, possibly physically isolated, etc. Biometrics are good at authenticating a human body _locally_, but that is also where passwords are just as good: it is very common to use a generic smartcard or a 4-digit PIN to enter your workplace.