is Fingerprint shared with 3rd parties?

giupardeb

HI guys, I have always been reluctant to use my fingerprint to unlock my phone, simply because I don't want it to be shared with third parties. I realize that having a long pin is annoying to have to type it in every time, so how does grapheneOS handle fingerprint storage? is there any evidence to reassure me that my footprint is not shared?
Thanks

Probably9857

What sort of evidence would you accept?

giupardeb

Probably9857 For example, is there a official document of google that explain how fingerprint works and how and where it stored? Its source code is opensource? Have any publicly disclosed security audits been carried out in recent years?
GOS improve the fingerprint managment? If yes, how does it do it?? and so on..

I hope I have been clear

Rizzler

Its not even shared on the cheapest chinese phones. iOS and Android store biometrics locally. You bet it won't be worse on GrapheneOS.

Probably9857

giupardeb

How about this?

https://support.google.com/pixelphone/answer/6300638?hl=en#zippy=%2Cfingerprint-hardware-security-requirements%2Cfingerprint-template-authentication-requirements

I don't think GrapheneOS changes anything with fingerprint storage.

giupardeb

Probably9857 thanks, even if the page is not detailed.. I'm looking for something more detailed..

de0u

giupardeb I'm looking for something more detailed..

Blastoidea

I’m curious about what information OP thinks he isn’t getting.

mtukl

The fingerprint model is stored inside of the Secure Element Keystore (Titan M2) and is never handed over to the OS. The M2 is secure enough for pretty much any use case, so there is only little reason to worry - especially in auditable, large and well-maintained projects like GrapheneOS.

giupardeb

Thank you all for your willingness to answer me. I was trying to retrieve as much information as possible on how the fingerprint works and how it is stored in Android and thanks to you I succeeded. I was also looking for public security audits that would attempt to extract the fingerprint stored inside the TEE in order to decrypt it, but I understand there are no studies on this.

Thanks again