My first question after reading the excerpt was the obvious Heisenberg uncertainty principal one of frequency vs time. Namely, that ~1Hz is a damn low frequency, so how much time would you have to sample for just in order to collect enough entropy to tell one person from another?

Luckily article offers a claim here as well.

an invisible, quarter-size laser spot could be kept on a target. It takes about 30 seconds to get a good return, so at present the device is only effective where the subject is sitting or standing.

It's not clear to me what's going to look different about my pulse after only 30 beats compared to somebody else? Are they measuring something more subtle than timing between pulses, like listening to the hiss of individual blood cells streaming through schlerotic valves? :P