http://blog.dustinkirkland.com/2013/10/fingerprints-are-user... bears repeating. If you can't change it then it doesn't make for a good passwords as there's no revocation.

This sort of thing is useful as a signal when deciding if a user is who they say they are, but it's not sufficient on it's own.