I keep seeing these articles where people can unlock phones and other devices using printouts or 3D models of a persons head. [1] It seems to me that your head is a "thing you have" and you should also need a "thing you know". Should this be a password, or perhaps a set of gestures? i.e. wink, wink, frown smile.[1] - https://www.forbes.com/sites/thomasbrewster/2018/12/13/we-broke-into-a-bunch-of-android-phones-with-a-3d-printed-head/