Storage of the fingerprint when using fingerprint unlocking methode

gnaabook

Hello,
I want to know if someone that can acess my phone (via malware or by sucessfully unlocking it) can acess the stored fingerprint data. What I mean by fingerprint data is a non-hashed version of it. Similar to the fingerprints used by cops.
Thx

Novalissoide

gnaabook If an advanced adversary has your physical device, they have your unhashed fingerprints all over it without unlock, unless you wiped the device deliberately to remove them.
This is one reason biometrics is less suitable for 'hard' access control but may be a convenient part of it.

de0u

gnaabook Here is some information about Google's requirements: https://source.android.com/docs/security/features/biometric#hal-implementation

I think Pixels store hashes, not fingerprint images, but I am not quickly finding information about that.

Eumenia

gnaabook
Your fingerprint is stored on the secure element and it's a lot easier to just get the fingerprint off of your device display, than to hack the secure element.

de0u

Eumenia It's a lot easier to just get the fingerprint off of your device display, than to hack the secure element.

That assumes physical possession. But if the device did store actual fingerprints and they could be exfiltrated then a remote attacker would be a possibility.

Eumenia

de0u That assumes physical possession. But if the device did store actual fingerprints and they could be exfiltrated then a remote attacker would be a possibility.

I think having such a strong zero day and using it on the OP is more unlikely then taking the fingerprint off the device

Dboy

de0u Do you mean that using a "digital" fingerprint on a device could be remotely hacked by an attacker? So, is it more secure to not using it?