But it's not being used as a username, it's being used as a password. (Or rather, a username and a password.) It's hacking to bypass even a trivial password, s

But it's not being used as a username, it's being used as a password. (Or rather, a username and a password.) It's hacking to bypass even a trivial password, so similarly it should be unreasonable to compel disclosure of even a trivial password... They don't need your usename - your phone assumes it's you and only asks for the password... The fingerprint that they're seeking is not a username, it's a crappy password.