Is fingerprint unlock a security flaw?

johndoe01

Hello,

I would like to know if the fingerprint unlock is a security flaw if my phone is somehow seized by law enforcement?

Thanks!

Equal2024

Depending on where you live, you may not be required to disclose a passcode or alphanumeric password to law enforcement, but biometrics (such as your fingerprint) do not fall under these laws, and so you may be legally obligated to unlock it: https://en.wikipedia.org/wiki/Key_disclosure_laws

GrapheneOS allows you to set up auto-reboot, which will set your phone into BFU (before-first-unlock) mode, which requires your passocde/password, even if you have a fingerprint unlock set. You could set your phone to reboot every 8 hours. Another perk of this is that most malware cannot persist after a reboot due to verified boot—which is why advanced malware like Pegasus prevents you from turning your phone off and pretending it is off when 'turned off' by the user so it can persist. Though, if you have malware installed on your phone, you have bigger problems...

Additionally, biometric unlocking might be easier than you assume with a motivated threat actor. You can, for example, extract a thumbprint from a high-resolution picture. So, most politicians should probably not be protecting their phones with their own thumbprints. A thumbprint is technically more secure because it's more complicated than a 6-digit passcode. A 16+ character alphanumeric password would be the most secure option, but it is not convenient.

Another thing to consider is that the Titan chip inside of Pixel phones is designed to combat rate-limit bypass attacks. Cellebrite and other tools work primarily by trying to bypass rate-limiting. For example, if you get the pin code wrong 5 times in a row, you might not be able to try another pin for a time. Cellebrite makes brute-forcing attacks possible in a reasonable amount of time by disabling this limit. With a Pixel phone, the amount of time between each attempt increases after a certain amount of failures, until after 150 attempts, you can only make 1 attempt a day. More reading here: https://github.com/Peter-Easton/GrapheneOS-Knowledge/blob/master/GrapheneOS-Security-Q%26A.md#does-graphene-allow-me-to-nuke-my-data-if-say-the-phone-gets-ten-incorrect-guesses-at-the-pincode

So this makes using a short pin more secure on a Pixel phone, because the Titan chip is a much harder to defense to get past than purely software-based rate-limits.

It's not a clear-cut situation. You need to decide what compromises you want to make.

johndoe01

Equal2024 Thank you very much for this complete answer! 👌

guser39

Equal2024 You can, for example, extract a thumbprint from a high-resolution picture.

It is also worth pointing out that if your adversary is this motivated then it is very likely they'd go the easier route of just shoulder surfing your PIN.

To the OP:

It is my opinion that shoulder surfing is a bigger threat than fingerprint cloning for most people. Supposedly, there has been an uptick in criminals shoulder surfing people to obtain device unlock codes then stealing devices. If criminals can do this then it isn't a stretch that more resourced entities can, too. Domestic abusers are also very likely to have plenty of opportunity to shoulder surf and even obtain fingerprints; this is a very complicated threat model but worth mentioning.

As others have mentioned, fingerprints can be "cloned" or coerced. If you're going through an area of risk then use the device lockdown mode or reboot (or power off) the device.

Generally speaking, using a fingerprint in public is likely to be more secure. If you only unlock your device in private areas then a PIN or password is going to be better than a fingerprint.

[deleted]

I will add to this and say, It's very unlikely for your phone to be seized outside the Fourteen Eyes by law enforcement, unless you are doing Illegitimate activities.

As a personal security measure, I choose to disable Android's fingerprint unlock feature when going through security checkpoints, such as airport baggage security checks. By doing so, I take steps to safeguard my sensitive data and maintain control over its access in such environments.

Pacienco

[deleted]

It's very unlikely for your phone to be seized outside the Fourteen Eyes by law enforcement, unless you are doing Illegitimate activities.

This is unusually specific. Could you explain why?

[deleted]

Pacienco Law enforcement agencies typically focus their resources on areas where they have jurisdiction and authority. The Fourteen Eyes refers to a surveillance alliance comprising several countries, primarily English-speaking nations. These countries have established cooperative agreements for intelligence sharing. Thus, law enforcement agencies within these countries are more likely to collaborate on investigations and share information.

"Five Eyes" alliance consists of:

United States
United Kingdom
Canada
Australia
New Zealand

"Fourteen Eyes" is a expanded intelligence alliance that includes the "Five Eyes" countries as well as the following nine additional countries:

Denmark
France
Netherlands
Norway
Germany
Belgium
Italy
Sweden
Spain

So when it comes to phone seizures, law enforcement agencies in non-Fourteen Eyes countries may have limited access to international intelligence databases and cooperation. Therefore, unless you are engaged in illegitimate activities that draw significant attention, it is less likely for your phone to be seized outside the Fourteen Eyes by law enforcement.

Pacienco

[deleted]

Thank you for taking the time to give this reply. I guess I do not understand why we would need to assume that the only existing intelligence sharing agreements (relevant to phone confiscation/database access!) will be the US-centric ones disclosed in a decade-old leak (Wikipedia only cites Snowden leaks)?

I understand you have expressed these in terms of likelihood though, I just think more care and research is needed on a topic like this. EDIT: Especially the assumption that phone seizure is so heavily contingent on these kinds of agreements (with the knowledge that extraction/cracking tools are sold worldwide with no such restrictions).

Equal2024

guser39 For PINs, you can enable PIN scrambling, which makes it much harder to guess what PIN number is being entered if you are not directly behind the person entering the PIN number. Even if you are, the numbers are in a different place than a typical numpad, so it may be harder to remember.

The long alphanumeric password is better, because there are many more characters to remember, so it is much harder to obtain the password from shoulder surfing unless you get a recording of it. I still believe it is the most secure option currently, but fingerprint unlocking provides similar security guarantees for significantly increased convenience.

It's worth mentioning that, if you are vulnerable to getting your PIN stolen through shoulder surfing, you are also vulnerable to getting your device snatched while it's unlocked. You need to be aware of the people around you when unlocking your phone.

GrapheneOS plans to eventually implement fingerprint unlocking as a second factor only for first-unlock: https://github.com/GrapheneOS/os-issue-tracker/issues/28

This would be more secure and fit both threat models, but raises the unfortunate possibility of being locked out of your own phone if it is the first unlock. Fingerprint detection is not perfect, after all.

[deleted]

Pacienco

I just think more care and research is needed on a topic like this

I would agree.

Tealk

What options are there to prevent being forced to use the biometrics?
It would need a one tip solution to disable it for emergencies.

The automatic restart of the device does not help in this case.

Phead

Tealk

Maybe the lockdown mode? Power button > lock

Equal2024

Tealk Lockdown Mode is the fastest way to get your data back to rest. Read more here: https://github.com/GrapheneOS/os-issue-tracker/issues/1741#issuecomment-1328364490

There's no one tap method to disable biometric unlocking, but you can do this in less than 5 seconds.

Tealk

Phead Possibly, I have not been in a situation where I would have needed it, so I do not know how practical it is.

matchboxbananasynergy

Equal2024 Lockdown doesn't get your data back to rest. It doesn't encrypt it. It only disables biometrics.

Equal2024

matchboxbananasynergy The linked comment implies that Lockdown mode 'gets data back to rest':

GrapheneOS already changed it so that it gets locked out after 5 failed attempts, and there's the standard lockdown feature to disable it another way. Rebooting or the end session feature for secondary users that we enable are even better options getting data back at rest.

treequell

Equal2024 even better options getting data back at rest

That's if you restart your phone or end session of a secondary user profile, not if you enter lockdown mode.

Msanders

Very interesting thread! In the end it seems to depend on your thread model and environment, but I can't help but wonder if it is possible that biometric data get leaked like it happens for other personal data (emails, passwords...) from cyber attacks for instance? In this case, it couldn't it be used to impersonate the phone user? Am I being too paranoid here?

Ammako

Msanders let's say I added fingerprint unlock to my phone. It would be the only place where I'm using my fingerprint as authentication, because I don't use that anywhere else. The fingerprint data is never stored as-is in the first place, the Trusted Execution Environment only has a hash of your fingerprint data (in layman's terms.)

Now, let's say a kind of vulnerability happened and was exploited that could somehow leak that fingerprint hash from the TEE. Let's say somehow the data was in the right format that you could use that hash to fool another system. It still doesn't let someone else steal my identity, because that information is not used for authentication anywhere else anyway. All it could be used for is unlocking my phone, which is a moot point if you already had an remote exploit powerful enough to even extract fingerprint data from the TEE.

This is all hypotheticals, by the way. Even root cannot access the fingerprint data. There would need to be a significant hardware flaw for the TEE to even be able to leak fingerprint data in the first place. Only the TEE should have access to the fingerprint reader, the OS (or individual applications) only receive a "yes" or a "no" from the TEE when checking fingerprint data. and as for the fingerprint data, it should be specifically signed with device- and user-specific keys, meaning the stolen fingerprint data wouldnt be useable anywhere else than on your phone anyway.

If the impersonation you're worried about is for an attacker to be able to make actions on your phone as if they were the user, they don't need the fingerprint data for that if they had an exploit strong enough to even breach the TEE. Even just root access would be enough to impersonate any user on the device and do things on their behalf.

You can probably trust that Pixel phones follow these guidelines, but other manufacturers might not handle fingerprints nearly as securely, so be warned.

https://support.google.com/pixelphone/answer/6300638

By the way: if it's your actual fingerprint you're worried about being stolen, you are leaving it on almost everything you touch on a daily basis. It would be trivial for a motivated attacker to lift your prints and copy them. Getting a device or system to accept modified fingerprint data might be a bit more difficult, but you probably aren't using fingerprint data as a main method of authentication for real life stuff, so it's unlikely someone could successfully impersonate you just by having your fingerprint anyway.

Msanders

Ammako Hi, I was not expecting such a detailed answer and I really appreciate the time you spent to reply, this is a very interesting read. Thank you very much!