The simple answer is: (1) yes, (2) it's very expensive, and (3) it doesn't work reliably enough to have any practical value for security/"password" purposes.
Check out this article if you want to learn why...
http://www.rense.com/general76/tfface.htm
I think there are a few promising applications for face scanning software, but not for security purposes. For example, wouldn't it be great to scan the face of a friend in a digital photo and have the software search through all your photos and find the ones with him in them. It would sure make assigning tags and keywords a lot easier.
There are several companies working on these sorts of applications, where even 60-70% reliability would be quite acceptable, relative to doing the job manually.
You can easily check out what face-scanning software is available by doing a Google search with that phrase. And, if you are interested in Internet security issues in general, try...
http://Confidential-Transactions.com