On modern Windows systems, biometric authentication (including fingerprints) is handled by Windows Hello, which makes it basically as trustworthy as the rest of the system, and leaves less room for a vendor (in this case, Lenovo and/or Goodix) to do privacy-compromising things.
Fingerprint readers can operate in one of two ways:
- Software verification, where the sensor simply passes the raw fingerprint data to userland software for verification.
- Hardware verification ("Enhanced Sign-in Security"), where the fingerprint model is stored in the fingerprint reader module itself, and the hardware performs verification internally, and raw data is not passed to userland.
See here if you want to determine which mode your system supports.
Microsoft also provides this documentation about how Windows Hello works, which includes information about how biometric data is stored:
Where is Windows Hello data stored?
The biometric data used to support Windows Hello is stored on the local device only. It doesn't roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data from a device, it cannot be converted back into a raw biometric sample that could be recognized by the biometric sensor.
Note: Each sensor on a device will have its own biometric database file where template data is stored. Each database has a unique, randomly generated key that is encrypted to the system. The template data for the sensor will be encrypted with this per-database key using AES with CBC chaining mode. The hash is SHA256. Some fingerprint sensors have the capability to complete matching on the fingerprint sensor module instead of in the OS. These sensors will store biometric data on the fingerprint module instead of in the database file.
Finally, Microsoft manually reviews fingerprint reader drivers before they can be distributed, so there's hopefully at least some level of assurance that your fingerprint hardware vendor isn't doing anything nefarious.
So:
- Your fingerprint data is always stored locally and never (intentionally) uploaded anywhere.
- The data is either stored in an on-disk database that is encrypted with a device-unique key, or in hardware where it is presumably not exportable or accessible to any software.
- Matching is performed by the operating system or the hardware.
- The data which is stored (whether in a database file or in hardware)—much like a password hash—cannot be used to reconstruct the original fingerprint.
Given the above, I see no reason to trust a fingerprint reader any less than the rest of your system. At the end of the day, the fingerprint reader is just an input device the same as your keyboard, mouse, camera, and microphone, and each of those devices and/or the regular files stored on disk are arguably much more attractive as a means of violating your privacy.
On Linux, fingerprints are handled by the fprint project, which anyone can audit for trustworthiness if so inclined.
On Macs, Touch ID functions largely similarly to Windows:
The chip in your device includes an advanced security architecture called the Secure Enclave, which was developed to protect your passcode and fingerprint data. Touch ID doesn't store any images of your fingerprint, and instead relies only on a mathematical representation. It isn't possible for someone to reverse engineer your actual fingerprint image from this stored data.
Your fingerprint data is encrypted, stored on disk, and protected with a key available only to the Secure Enclave. Your fingerprint data is used only by the Secure Enclave to verify that your fingerprint matches the enrolled fingerprint data. It can’t be accessed by the OS on your device or by any applications running on it. It's never stored on Apple servers, it's never backed up to iCloud or anywhere else, and it can't be used to match against other fingerprint databases.
