Android 10 Biometric Manager Security

Android is deprecating FingerprintManager in favor of BiometricManager since the end of 2019. The update is great news for developers and designers as they do not need to solve much of the tedious biometrics design and behavior.

However...

• This prevents developers from avoiding less secure biometric options, the only workaround seems to be falling back to using FingerprintManager in order to ensure a secure authentication method is used. Case in point: unlike Apple, Samsung did not solve Facial Recognition properly and security concerns force companies to not recognize all biometrics as equally secure.

https://edit.theappbusiness.com/androidx-biometricprompt-vs-fingerprintmanager-the-good-and-the-ugly-c15a1b3a67d7

Manufacturers like Samsung warn you about-face recognition not being a strong check as the device can be tricked with a picture. What if you are developing a banking app and concerned about the security and reliability of these new biometric authentication methods? What if you are designing and building an app that has to work just with fingerprints? Then the FingerprintManager comes into play.

However, if you are concerned about the security of these new biometrics or have a design constraint and you want to restrict the biometric authentication to use just fingerprints, your best solution is to use the deprecated FingerprintManager.

• In other news, Pixel 4 does not support Fingerprint authentication and instead implemented a secure Face ID technology that is able to be used by a variety of banking apps including Google Pay, etc.

https://www.androidcentral.com/why-google-dropped-fingerprint-sensor-and-why-thats-bad-thing

As you reach for Pixel 4, Soli proactively turns on the face unlock sensors, recognizing that you may want to unlock your phone. If the face unlock sensors and algorithms recognize you, the phone will open as you pick it up, all in one motion. Better yet, face unlock works in almost any orientation—even if you're holding it upside down—and you can use it for secure payments and app authentication too.

The new best practice and the newer phones sound great but this complicates things when various OEM implement insecure biometrics. How are we, as application developers, supposed to be handling this conundrum?

Starting with Android 11 we can check for the Biometrics Authentication strength defined by BiometricManager.Authenticators. The Authenticators define whether the biometric is strong or weak.

You can know more about it in the following link

BiometricManager.Authenticators

As of now only developer preview of Android 11 is out.So not sure how the final version of the Biometrics will be.

Quoted from Android developers blog,

You can learn more about the features in developer preview here,

Android 11 developer Preview