Preaching to the choir, I know, but every time a story like this comes along I'm hopeful that people will recognise that relying on biometric identifiers is a really bad idea. This one's worse than usual: people thought iris scanning was more secure (than, say, fingerprints), but it turns out to be less secure as it's probably not all that difficult to use contact lenses to fool a scanner.

It seems like a simple fix would help make this more secure in the real world: orientation- make it more difficult for a contact lens to work (now it has to be rotated in the correct angle) I can't think of a reason this would be hard to implement in software....

biometrics needs to get comprehensive, with dozens of separate identifying features, and no public release of what those features are.

Security through obscurity?

That is what a password is.