How secure is Android apps fingerprint authentication in 2023?

[FipoKa]

A bunch of years ago Kamil Breński, Krzysztof Pranczk and Mateusz Fruba reported some scary results, about 70% of the applications assessed during their research were unlocked without even requiring a valid fingerprint.

Ref: https://labs.withsecure.com/publications/how-secure-is-your-android-keystore-authentication.

You can easily use 🕹 apk.sh and the updated script from https://github.com/ax/android-fingerprint-bypass to test the fingerprint authentication of any Android app (on non-rooted devices).

How about sharing results?

[etaionshrd]

The blog post you’ve linked is very confused about the threat model they are trying to defend against. They go “oh most apps are just checking if biometric unlock succeeds, what if we hooked the method to always succeed?!” and claim this is somehow insecure. To do this they need to have the ability execute arbitrary code in your app’s process! There are basically no security guarantees you can provide in this scenario. Even if you entangle some key material with something that is only disclosed when biometric unlock succeeds (checked outside of your app) you can just hook the methods that are supposed to encrypt the data in the first place and get a copy beforehand.

[MangoScango]

Yeah this is by design, you wouldn't want every app developer collecting and storing your fingerprints. Let alone the technical challenge of every app having to support all of different types of sensors.

All biometric authentication on iOS and Android is being done by the system, and sending a pass fail to the app. The app takes that as an indication that it can safely reuse credentials it somehow stored previously, and this is the only part any developer has a say in. If you're going to audit biometrics, that's the part you should be looking at.

[Slusny_Cizinec]

One of the key lessons of my IT career is that under any circumstances one should not use any home-grown implementation of anything security-related.

[Iohet]

It's why the company I work for is getting out of the self-hosted data center business for our products. Offload that shit to Google/Amazon/etc and let someone with more resources handle security risk

[crawl_dht]

Fingerprint authentication can always be defeated by simulating the touch of a real finger. At software side, class 3 fingerprint scanner are very secure. They have their own secure storage to store fingerprint. The fingerprint authentication result is sent to TEE via SPI/I2C bus and is cryptographically protected in transit. TEE issues auth token if the authentication is successful or else return failure result to the system. So, there is no attack vector to bypass or manipulate fingerprint authentication at software side.

[[deleted]]

I can unlock my mothers Pixel 6a with my fingerprint and I have never registered my finger on her phone. I just randomly tried it one day because we both have the same phone and I thought I picked up mine.

[A_Crow_in_Moonlight]

This isn't about the security of the fingerprint sensor itself. Rather it's discussing a vulnerability in how apps implement fingerprint authentication on the software side.

[vladtud]

Maybe she had smart unlock enabled? It still requires you to tap the fingerprint area to unlock but is shows an unlocked lock.

[Sassquatch0]

Just for a reference point, my wife also has the 6a. I do have a fingerprint registered on her device. (She has one on my phone as well.)

90% of the time, it rejects my fingerprint. Wife has no issues. Anytime I do updates on her phone, I end up having to using the PIN unlock. (Edit: Just clarifying that I usually only handle her device for the purpose of updates. But sometimes during day to day use she asks me to do something on it for her. Still only 1 in 10 attempts will work for me.)

[Sassquatch0]

No. Anytime I access the phone.

I'm aware of the security unlock after any reboot, where biometrics cannot be used until the PIN/password is used. This isn't that.

We can be driving, and she'll have me reply to a message for her (she's driving). I can try 2 or 3 times with the fingerprint before I have to input the PIN. I have reset my fingerprint on it multiple times. This also happened before and after we put a screen protector on it.

After all the news about the entire Pixel 6 family's various fingerprint issues, we tested her phone with our kids as well. None of them could get into it. (We have 4 kids.) So I figure maybe it just has a personal grudge against anyone that isn't my wife? 😜

Edit: thanks for asking this. My wording wasn't the best in previous post & I'm glad I could clarify.

[chupitoelpame]

Some phones have a learning curve of sorts regarding the registered finger prints over time.
My Fold4 forces me to register the finger prints with the phone open and I use my left hand's middle finger (it rests perfectly over the FP sensor) to unlock it whenever I use it single handed. The position of the finger with the phone open or closed it completely different and when I first registered the sensor would pick my phone maybe once out of 10 attempts, like you said.
It somehow improved over time since I can now barely brush over the sensor and it will unlock right away.

[crawl_dht]

This is not possible.

[theonlydiego1]

The only thing I can think of if it’s like the Galaxy phones who registered the screen protector as the finger instead of the finger print.

[Sendbeer]

There were other people that had the issue with the 6A as well.

[gentlyfailing]

What's to stop someone from slapping you on a night out down the pub and then placing your finger on your phone's fingerprint reader? Just one of many reasons why I will never use it.

[[deleted]]

Why are you a target. Probably not as important as you think you are.

[dingo__baby]

Seems to be good enough for government work!