Without the touch ID, a long password is too inconvenient.

Care to explain why? I know it's possible to clone someone's fingerprint, but that's doable in nearly clinical settings, where you have a very,very clear image of the fingerprint in the first place - a phone stolen out of a pocket or handbag is not going to have them.