[rocqua]

The biggest gray area currently is whether typing in a password is 'something you do' or 'something you know'

It seems pretty clear to me that a password is 'something you know', whilst a fingerprint is 'something you are'. Moreover, typing in a password is very clearly a communicative act, whilst placing a finger on a scanner is a lot more murky. It might communicate intent, but it can't communicate ideas.

Maybe things change if you need to know which fingers work.