For phone login and such you can't really attempt a password without being physically in front of the phone anyway, so any device from any individual doesn't really apply, in this case.

"For that kind of adversary, password is vulnerable, and biometrics is secure."

The applications I'm familiar with, the password takes precedence. It doesn't require password and fingerprint.

The thing is, if you add an extra factor, either you are required to use all of them, in which case it increases the risk of being wrongly locked out, or you are required to use any of them, in which case it increases the risk of the wrong person getting in.

I have an iPhone (fingerprints) and Android phone (password only). My adversary: my jealous girlfriend.

I found it functionally impossible to secure the android against my girlfriend as she could watch me enter any code or password multiple times.

She was not able to get into the iPhone, because the biometrics prevented her from being able to view the passcode being entered.

Summary: biometrics are a reasonable substitute for a trusting relationship. :)

Don't you ever find that the fingerprint recognition fails? And in that case, can't you use your passcode? If not, then you're locked out.

It fails very rarely mostly if my hand is wet. Yes you can use the passcode and you are required to enter the passcode at lease once a week by design. But opportunity for shoulder surfing is reduced by a factor of hundreds since I probably unlock my phone 100 times a day.