I feel like you're missing the forest for one particular tree that's about the get chopped down. Memorized secrets, in some form or another, will probably always be a linchpin of security, if not for phone login than for disk encryption, unlocking smart cards and the like.

> we are moving away from passcodes

Who is moving away from passcodes? AFAIK, all major smartphone operating systems support passcode authentication.

Folks tried to say the same thing when fingerprint readers were integrated on smartphones, and here we are, still able to use passcodes...

Yet a large number (and probably the majority with the capability) of people use fingerprint scanners or face unlock.

How many of those people understand that those lock methods are not covered by the fifth amendment?

I'm not arguing that those methods aren't popular, but that 'we' are not all moving away from passcodes to using them. There are still folks using passcodes, and passcodes continue to be a supported authentication mechanism.

I really wish Apple would offer two-factor auth in the form of fingerprint then PIN. Is that an option on the iPhone Xs with Face ID?

It's something I feel Windows Hello gets right some of the time, but not enough recognition for. Windows Hello can be set to (and I believe defaults to) require PINs/passwords on the first time a device boots up or asks a security challenge, thereby the face rec or thumbprint ID challenge itself is only for "repeat" checks / secondary factor.

This is what Android has done since biometric auth support was added.

This is exactly how iOS works...

It is not. If you prefer, you can use just a password, in lieu of Face/Touch ID, but there's no support for requiring both to unlock.

That's what I do on my phone. I have a fairly lengthy passphrase and Smart Lock.

Then what happens when it can’t read your fingerprint or face?