Why does Android care about differentiating multiple fingerprints?

Question

I was reading through the Android Compatibility Definition document after a friend pointed me there while we were discussing fingerprint scanners and other biometric authentications. I noticed this requirement that seems unusual:

MUST NOT enable 3rd-party applications to distinguish between individual fingerprints.

I found this article which seems to be wondering the same thing, with no conclusions, although one person in the comments suggests that it might be a way to avoid patent infringement. Now, I can definitely see patent issues as being possible - one useful patentable idea that comes to mind is a phone having two modes, the 'real' mode that you use, and a 'fake' mode that hides personal information, contacts, etc, which you unlock with a different finger, unknown to a person trying to force you to give them access.

I haven't been able to find any definitive answers, though, so I'm curious if there's something I'm overlooking. Are there any known security vulnerabilities relating to a program being able to distinguish which finger is used to authenticate?

Answer 1

A bit of a wild guess here: privacy and anonymity.

Having worked on ePassport software, I can tell you that developers need to be extra careful when handling users' fingerprint and iris data. Think of how careful we are about storing usernames, passwords, credit card numbers, etc, then consider that in the case of a breach, passwords and credit card numbers can be changed ... fingerprints not so much. I support the idea of being careful around biometric data - even if there's no obvious reason for it.

---

That said, here's an example where it might matter:

If you've set up your device to have a shared account used by multiple people, allowing apps to distinguish fingerprints would de-anonymize the users.

On personal devices like phones and tablets that's probably an obscure use-case, but with Android being used in more and more embedded devices, keeping 3rd party apps behind a privacy barrier makes sense. Take for example a livingroom entertainment system that's used by the whole family: the music streaming app needs to know whether it's authorized to bill you for purchases, but does not need to know which human did the unlocking. If you choose to give the app access to this information, then cool, but there's no reason for it to know it by default.

The Principle Of Least Privilege would say that if an app needs access to your biometrics, it should have to request that permission explicitly - just like any other permission in Android. By forbidding fingerprint device manufacturers from leaking distinguishability information to apps, Android has the ability to control access to this information through the OS' permission system.