2-factor fingerprint unlock feature is now fully implemented

Upstate1618 So you can use a strong diceware passphrase as your primary unlock method while having the convenience of fingerprint+PIN for secondary unlock. You avoid depending on secure element throttling to provide secure encryption for a random 6 digit PIN and you avoid it being possible to unlock your device with only your fingerprint. It's also more secure than solely using a fingerprint as a secondary unlock method because it also requires the PIN. You can benefit from the anti-shoulder-surfing properties of a fingerprint and scrambled PIN for the regular unlock method you use in public vs. a passphrase typed on a fixed layout keyboard.

IksNorTen You're missing what the feature does, perhaps because you haven't used biometric unlock on iOS or Android. On both iOS and Android, the way biometric unlock works is that you have a PIN/password as your primary unlock method and can enable biometric unlock as a secondary method only usable after first unlock for a limited amount of time since since the last successful primary unlock. They also enforce an attempt limit where if you fail too many times, you need to use the primary unlock method. This feature doesn't add any new twist to that system. Our feature adds the option to set a PIN which is required after successfully using a fingerprint in order to complete the unlocking process, that's all.

Using a random 6 digit PIN for your primary unlock method is a balance of convenience and security which entirely depends on secure element throttling for secure encryption. An attacker able to exploit the OS and then the secure element from there can bypass the encryption. It's extremely hard to exploit the high quality secure elements in Pixels but it's possible. As far as we know, Cellebrite still hasn't developed a Titan M2 exploit for the Pixel 6 and later but they did figure out how to exploit the Titan M1 eventually. Using a strong diceware passphrase avoids depending on anything that can be exploited. However, that's very inconvenient. That's where the iOS and Android biometric unlock via face/fingerprint comes in to make it convenient, but at a huge security cost. Biometric unlock can be physically forced. Your face or fingerprint could also be cloned in a way that allows them to unlock. You leave your fingerprints on everything you touch and your face can be recorded by multiple cameras at the same time almost anywhere you go.

The whole point of our new feature is enabling the security of a strong passphrase combined with the convenience of biometric unlock in the usual way that works on both iOS and Android, but with the twist of requiring a PIN to complete the fingerprint unlock process. It's quite a simple feature: you can set a PIN required to complete fingerprint unlock. You don't have to enable it.

There has been huge demand from a large portion of our userbase for something like this for years. Having secondary unlock via fingerprint+PIN instead of only fingerprint is a big deal.