This reminds me of apps like Shazam. While they definitely serve an amazing purpose (recognizing songs by finding a similar region of sound) what I would really like is an app that could recognize my humming a song--which probably sounds nothing like the actual song itself (different key, speed, entirely different voice, etc.)
Why is this a problem? When they request a password, reset the password to some typical password and pass that on to the authorities. They aren't actually going to ask to view your code/database, are they? They just want to be able to access one user's account.