In reply to Aleš Sýkora.

The idea is good and secure.

The issue is though that the user may be unfamiliar with the implications of the technology.

Basically authentication can become paired to an account on a device. Therefore a user who did not understand this could expose his Wordpress account if the account on the device is shared.

Not really an issue for face or fingerprint ids which can’t really be shared but a shared pin on a device then means everyone with the device pin can access the Wordpress account.