Nowadays, many mobile phones have supported unlocking through fingerprint recognition. However, both iOS and Android require users to enter the password after the device is rebooted, even though an authorized fingerprint is given.

My question is: why?

  • 12
    I can't answer because the question is protected and I have only 5 legit points, but in any case, have you considered the security aspect of someone physically forcing your finger onto the fingerprint reader, or worse, cutting off your finger in order to use it on your phone? By the device requiring the code at startup, if you think your phone is in danger you can shut it off and suddenly your finger is no longer interesting to cut off...
    – ErikE
    Commented Aug 21, 2016 at 3:33
  • 2
    @ErikE Yeah, this makes my fingers safer :) Also, forcing typing password each time the phone is rebooted makes it less possible for someone to forget it.
    – nalzok
    Commented Aug 21, 2016 at 3:46
  • I should have said no longer as interesting to cut off, because it has no primary purpose. Someone could still threaten to cut off fingers as torture or to make you unlock your phone, but that's still a whole different ball of wax than simply needing your finger off your dead body to get your phone contents.
    – ErikE
    Commented Aug 21, 2016 at 3:49
  • 4
    Can't answer either, but the law might protect you from being forced to give up your password to law enforcement even though they may have the right to take your fingerprints.
    – N.I.
    Commented Aug 22, 2016 at 6:38
  • 3
    @ErikE: I can't really imagine refusing to type my password into my phone when I'm being threatened by someone willing to cut off my finger. And even if I did refuse, now they have an interest in cutting off any number of my fingers to persuade me to co-operate, not just the one that unlocks the phone. So this seems like quite a niche feature if that was the real reason: it doesn't make your fingers any safer but it does keep your data safe if you lose them :-) Commented Aug 22, 2016 at 14:30

4 Answers 4



  • password is used to get access to the full disk encryption key
  • fingerprint is used to unlock the screen (of an already "decrypted" device)

Encryption key retrieval must be:

  • accurate - on each entry, the device must transform the password through a key-derivation function into the one and only correct encryption key, otherwise the device won't be able to decrypt the data
  • secure - derived through a one-way function, not "unlocked" by comparing data provided by a user with a pattern stored on the device

Fingerprint recognition does not meet the above requirements, it is:

  • fuzzy - on each press the sensor provides the device an approximate image of a part of a fingerprint which is matched at a certain accuracy; on each verification attempt the actual data differs due to different position, skew, press strength
  • non-secure - recognition is performed by comparing the actual fingerprint with the data stored on the device - this data must be both readable and modifiable which makes it vulnerable to an attacker
  • 1
    @Bakuriu I use OxygenOS 3.2.4 on my phone which is built on 6.0.1 and according to the settings uses encryption. However, I merely use fingerprint + pattern and can receive notifications before proving the pattern but the phone won't let me unlock it via fingerprint the first time I unlock it after a reboot. Because I can receive notifications, user applications definitely work before unlocking the phone the first time after a reboot.
    – UTF-8
    Commented Aug 20, 2016 at 18:36
  • 4
    @OrangeDog Even if some form of hashing is used, it is not a secure hash function. I can't see any statement in my answer that is incorrect or unclear. Would you explain your usage of "except"? If you have knowledge of cryptographically secure hash functions used for fingerprint recognition, please answer this question, I would be happy to learn about new developments in the area.
    – techraf
    Commented Aug 20, 2016 at 21:14
  • 2
    @UTF-8 Did you read the documentation? It mentions that in Android the services are divided into core, main and late_start. Core services start before encryption and keep running. Main start before encryption and are re-started after decryption, late_start start only after the decryption. It is possible that some part of the notification service is in either core or main and so it is started before decryption.
    – Bakuriu
    Commented Aug 21, 2016 at 7:54
  • 1
    I have just rebooted my phone, typed web.airdroid.com into my browser on my computer, it logged me automatically into airdroid which granted me access to the files stored on the virtual SD card. Just to be sure it doesn't just now the file names, I downloaded a photo before unlocking my phone. So /storage/emulated/0 where pretty much all the personal files are isn't encrypted, is it? The files in /etc aren't encrypted either. In fact, I haven't found a single folder in which files are encrypted (I either can't see them or or they only contain unintelligible data). Can you name one?
    – UTF-8
    Commented Aug 21, 2016 at 9:27
  • 1
    Airdroid shows me an empty folder if I try to access /data regardless of whether I unlocked my phone. That's probably because root access is required to view the contents of /data and airdroid doesn't have root access. Anyway, "full disk encryption" sounds pretty bold for not even encrypting the data on the virtual SD card. (I suppose it's encrypted but the pattern isn't part of the key, btw., but have no idea. The key would be known to the phone. That at least would make it impossible to access the data of a sold device if a factory reset changes the key.)
    – UTF-8
    Commented Aug 21, 2016 at 9:29

Because the fingerprint is only used for authentication, while the password is also used for encryption, and these are distinct processes with very different requirements.

As you probably know, the primary function of a lockscreen is to make sure that the person accessing your device is you. This is called authentication. If someone inserts the correct pin / password / fingerprint on a lockscreen, the device knows that that person is probably you, and grants you access to the system.

Besides authentication, the screen that asks you for your password when you boot up your phone also serves a different purpose. Modern phones feature something called Disk Encryption. This means that all the user data stored on the device is protected by a encryption algorithm.

When using a properly implemented disk encryption, given just the phone's storage, no one can access your data - not even the device itself! The kind of symmetric encryption used for this purpose uses a secret key, and this key is never stored by the device, for security purposes. Instead, the device must be told the correct key in order to access your data.

Now, because of the nature of this algorithm, a secret key needs to have some important properties:

  • It must be long
  • It must be exact. A key that is almost exactly the same as the secret key is completely useless

Unfortunately, it turns out that systems based on biometrics, such as a fingerprint reader, don't fulfill these properties. The amount of information provided by them is usually small and inexact.

This is the reason you need to enter your password - it's the only mechanism that we know of that properly fulfills the requirements. This is done by feeding your password through a key derivation function.

After booting up and being told your password, the phone keeps the derived encryption key in its volatile memory, so it doesn't need to ask for it again - only authenticate you. This has some disadvantages, such as making it vulnerable to a cold boot attack, but it's considered a good compromise between security and usability

  • I think to be accurate you'd have to say that the password is used for both authentication and encryption, not just encryption.
    – ErikE
    Commented Aug 22, 2016 at 17:04
  • @ErikE That's a good point, I've changed the introductory sentence
    – watchowl
    Commented Aug 24, 2016 at 21:30

AFAIK, at boot time you first have to unlock the SIM card, which requires a numeric password. Next operations just unlock the screen and for that part you have different authentication methods (not all are implemented on all devices):

  • numeric or alphanumeric password
  • fingerprint
  • gesture
  • nothing (screen is unlocked by simply moving a finger on it)

All those methods are directly processed by the phone, but the first is processed by the SIM card itself, and as it is far less powerfull than the phone, it accepts only a numeric password. Of course, the phone could certainly intercept the code but it would look like a man in the middle attack, and neither phone manufacturers, nor OS providers have wanted to implement it.

  • 1
    I would think that SIM locks are far less common (and less useful) than device encryption. Commented Aug 22, 2016 at 16:25
  • @MatthewRead, depends on location. Around here, all SIMs default to requiring PIN on start while most phones do not default to encrypted. Therefore SIM locks are vastly more common.
    – Jan Hudec
    Commented Aug 23, 2016 at 6:48
  • 1
    An unlocked SIM card would allow a thief to use your account to pass any phone call if he has another phone from the same provider. Commented Aug 24, 2016 at 15:38

Although the major concerns mentioned by others are accurate, precision and accuracy of a password is much higher than a fingerprint, I think it's worth mentioning drivers and algorithims.

That is to say, most of your hard drive space and code isn't available until you've un-ecrypted the drive, the code to read and interpret a fingerprint is almost certainly much more complex (large) than the code to read a password. Any code that is before the un-encryption is attack-able and adding that much code is a security risk in itself.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .