Something I have always pondered,...would it be more secure to request a password after the user has been identified by the system?<p>For example,...<p>1.  User clicks login
2.  Webcam uses facial recognition to identify the user.
3.  The identified user is requested to enter their password.<p>In this case, I think, it is harder to impersonate the real user.  I am no expert but would interested to know if anyone can see any obvious flaws or if something similar exists?