7

I was reading through the Android Compatibility Definition document after a friend pointed me there while we were discussing fingerprint scanners and other biometric authentications. I noticed this requirement that seems unusual:

MUST NOT enable 3rd-party applications to distinguish between individual fingerprints.

I found this article which seems to be wondering the same thing, with no conclusions, although one person in the comments suggests that it might be a way to avoid patent infringement. Now, I can definitely see patent issues as being possible - one useful patentable idea that comes to mind is a phone having two modes, the 'real' mode that you use, and a 'fake' mode that hides personal information, contacts, etc, which you unlock with a different finger, unknown to a person trying to force you to give them access.

I haven't been able to find any definitive answers, though, so I'm curious if there's something I'm overlooking. Are there any known security vulnerabilities relating to a program being able to distinguish which finger is used to authenticate?

|improve this question
5

A bit of a wild guess here: privacy and anonymity.

Having worked on ePassport software, I can tell you that developers need to be extra careful when handling users' fingerprint and iris data. Think of how careful we are about storing usernames, passwords, credit card numbers, etc, then consider that in the case of a breach, passwords and credit card numbers can be changed ... fingerprints not so much. I support the idea of being careful around biometric data - even if there's no obvious reason for it.

That said, here's an example where it might matter:

If you've set up your device to have a shared account used by multiple people, allowing apps to distinguish fingerprints would de-anonymize the users.

On personal devices like phones and tablets that's probably an obscure use-case, but with Android being used in more and more embedded devices, keeping 3rd party apps behind a privacy barrier makes sense. Take for example a livingroom entertainment system that's used by the whole family: the music streaming app needs to know whether it's authorized to bill you for purchases, but does not need to know which human did the unlocking. If you choose to give the app access to this information, then cool, but there's no reason for it to know it by default.

The Principle Of Least Privilege would say that if an app needs access to your biometrics, it should have to request that permission explicitly - just like any other permission in Android. By forbidding fingerprint device manufacturers from leaking distinguishability information to apps, Android has the ability to control access to this information through the OS' permission system.

|improve this answer
  • Hmm I could see that being the case if you weren't using the 'proper' method of making multiple users (which Android started supporting in 5.0). To be fair, I'm assuming that Android does allow determining which user swiped a finger, but not which finger they swiped, but I have no source to back up that assumption. – childofsoong May 17 '16 at 20:10
  • Also, I would think that it would be a feature, not a flaw, to know which person swiped their finger. I want my (imaginary) wife to be able to make purchases with my account, but not my (imaginary) kids. By the way, wanted to edit but it wasn't enough characters: you misspelled "distinguishability". – childofsoong May 17 '16 at 20:16
  • 2
    Having worked on ePassport software, I can tell you that developers need to be extra careful then handling users' fingerprint and iris data. Think of how careful we are about storing usernames, passwords, credit card numbers, etc, then consider that in the case of a breach, passwords and credit card numbers can be changed ... fingerprints not so much. I support the idea of being careful even if there's no immediate reason for it. – Mike Ounsworth May 17 '16 at 20:17
  • That's actually a really good point - if you want to add that to your answer, I'll mark it accepted. – childofsoong May 17 '16 at 20:18
  • @childofsoong Yeah, if you want the app to be able to tell you and your wife apart then I agree that you should be able to give it permission to see that data, but user should have to grant that permission, it shouldn't be on by default. – Mike Ounsworth May 17 '16 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.