Ideally you use an iris (or fingerprint) scan as one part of two-factor authentication.
Somebody who finds-out your password isn't likely to have your iris handy, and somebody who can borrow your iris or finger isn't going to also know your password.
How many colors in the list yellow, blue, chips, purple, pub and hotel?