What? Wow, that sounds really dangerous. The same fingerprint is available to any site out there, so anyone could just capture it and try to replay it on a "SecureAuth" service, no?
Here's how it works. As a user I want to connect to a web resource, I am redirected to my idp (SecureAuth) where we ask you your name, then I look at your account and ask you to enroll, then I ask you your password. Now before I generate a claim/token or what ever I take your fingerprint so for the next day/30 days/90 days or what ever your fingerprint is checked between your username/password and the strong authentication is transparent to the user.
The variables can all be weighted differently and the fingerprints can easily be revoked but it is very cool technology.
Hopefully that isn't the only mean of authentication.
What is it then? What if I upgrade the browser, will it accept whatever other auth factor I present (a password?) anyways? What's left then?