FAIRPHONE 3 and 3+ A13 - Fingerprint sensor update

Help Fairphone 3
342

I’m not suggesting they support A11 for later than there are security updates. I’m just saying that staying on A11 for now gives them the time they need to make a new fingerprint reader.

If you keep the A13 rollout, I can tell you that many people are going to tell themselves they’re never buying a Fairphone again, so why would you do that??

Plus, many people here are saying that the banking apps won’t work on A11 once the security updates stop. Are you 200% sure about that? I’m pretty sure it would not happen instantly.
Right now the apps don’t work because when they were developed, they all had this lvl 3 fingerprint requirement. But with A11, I’m pretty sure the banking apps would have to purposely push an update saying they don’t support it, so it would not happen instantly and maybe much later than what everyone thinks here.

Also banks might think twice before pushing an update that might remove support and frustrate A11 users. And that’s where a better logic for Fairphone comes in. When FP pushes A13 and things don’t work anymore, the user is obviously frustrated at FP. If the user is on A11 and one of his apps gets updated and doesn’t work anymore, the user will probably be frustrated at the company who makes the app (or at Google), not at Fairphone! So this A13 push is literally the worst marketing decision they could have done…

Last but not least: I’m also using a Google Pixel 3 XL for my work. It’s on A12, but the security updates are from 2021 and will never be officially updated by Google anymore. Guess what, all of the banking apps work (all the ones from Switzerland that are in the list).

Screenshot_20230806-093707
Screenshot_20230806-0937071440×2960 163 KB

4 Likes
343

I think app compatibility is down to the installed android version rather than the security patch level. Your 3XL should be okay for at least another 15 months.

I’m pretty sure those who stick with A11 on their FP3 will find their banking apps continue to work until A11 is EOL.

The FP3 was manufactured in 2019 with the FP3+ a year later. Fairphone promised 5 years of updates for this model. If Fairphone did magic up a new sensor for say €100 (unlikely they will), would people be happy to pay that knowing updates could be ended as early as mid 2025?

1 Like
344

My understanding is that it’s up to the app developers whether they should go by security level or Android version. I know that in another thread, quite a few people were upset when their work apps stopped working after 2 months of no security updates.

Most other stuff will keep working for years to come. The Swedish counterpart of the Austrian AMT (?) requires Android 6 or newer and targets SDK 32 (Android 12)

2 Likes
345

Not surprisingly HSBC app no longer works from sensor. A little surprised that the Resideo app to control my central heating app needs that level of security but clearly it does as that also now requires me to log in with a numerical code. With HSBC the numerical code is only 6 digits so not really mega secure.

1 Like
346

I have read contradicting “info” (opinions?) about whether FP will supply A11 security updates for the FP3 until end23 / early24, leaving some breathing room for those who are not ready yet for the update (and the potential issues it introduces like any major OS update)
Any “official” statement yet ? Can I safely stay on A11 until 1Q24 ?

1 Like
347

Dear all, a new update from our side!

(Thanks for your patience… I hope you understand it takes a while to write these updates as we are a big team, and insights are needed from many people) :slight_smile:

The Android 13 rollout finished on the 29th of July, which means it is now available to all users. However, we want to give everyone who prefers to continue using their Fairphone 3(+) with Android 11, the option to do so until the moment Google stops providing security updates later in (early) 2024. Until then, we will be providing users of the Fairphone 3(+) with Android 11 security updates for manual installation every two months.

This also means all users who updated to Android 13 will be able to revert back to Android 11, if they want to.

If you are still on Android 11 and want to stay,

now it should be possible to ignore your Android 13 update notification (the notification will only appear every 2 weeks and in time we will remove this).

If you are already on Android 13, please follow the instructions here to revert to Android 11.

This will allow for you to go back to using your fingerprint sensor with secure apps.
Please beware! Following these instructions will mean you will need to erase your data). Reverting to Android 11 will not change your Google security patch level.

From now on, further security updates on Android 11 will not be provided Over The Air (OTA), but will need to be updated manually via a laptop or computer. You can expect a new Android 11 software update every 2 months here. You will get the news via our forum.

Please note that this will not influence our regular security update process for Android 13. Users of Android 13 will continue to receive updates as usual.

A reminder that,

all apps that offer biometric login also offer the option to login using your password or pin code. This issue therefore does not mean you will not be able to access your apps at all with Android 13. We are so far only aware of one app where this is not the case - the Austrian government application “Digitales Amt”. However, we have confirmed that login is still possible for this app by using an inexpensive hardware key (see a list of compatible hardware here).

We’re sorry

We realize these are only workarounds or temporary fixes. However, please keep in mind that, as inconvenient as the pin/password workaround might be, the update to Android 13 does provide many new perks and features that we hope will enhance your user experience and inspire you to keep using your Fairphone for as long as possible.

New FAQs

We have updated the FAQs below to include multiple new questions and answers that some of you have been raising (eg. around the possibility to provide a new fingerprint sensor). Apologies that it took sometime to bring the teams together to have an informed answer on that one! I hope this clarifies things a bit.

If you have any issue reverting to Android 11 please contact our customer support.

Thanks for your continued support.

Miquel (& and many others!)




New and updated FAQs

Why can you not upgrade the hardware / offer a new fingerprint sensor module for the Fairphone 3?

Click here to read the answer

Before answering this question we wanted to make sure we had enough information.

The fingerprint sensor itself is just one of the components within the fingerprint sub-assembly. The design, pin configuration, and other aspects of the sensor may vary between different manufacturers and models. Therefore, the FPCs (flexible printed circuits) would likely require re-layout, and the module would need to undergo a comprehensive process of review, firmware/driver development, testing, validation, and certification when considering a new fingerprint sensor.

When designing Fairphone 3, we underestimated the risk of this happening and did not make the fingerprint sensor an easy replaceable module. We are at the moment trying to make sure this does not happen in the future with Fairphone 4.

In order to offer a hardware fix now, we would need to find a manufacturer that is willing to put in the effort outlined above. This is very difficult. Normally, manufacturers would require a minimum lifetime commitment on sales of over 100,000 units in order to earn that development back. At this point, we are not selling FP3s anymore so the uptake would be very small. With what we know now, this is a very unlikely possibility, but please trust that we are considering all options. In any case this change would take a long time. We therefore believe that the option to downgrade to Android 11 is the only possibility in the short term.

Will I no longer be able to access my banking app / other apps that I usually use the biometric login for? - UPDATED 8th August

Click here to read the answer

All apps that offer biometric login also offer the option to login using your password or pin code. This issue therefore does not mean you will not be able to access your apps at all. We are so far only aware of one app where this is not the case - the Austrian government application “Digitales Amt”. However, we have confirmed that login is still possible for this app by using a hardware key (see a list of compatible hardware here).

(When) will you fix this? Is there a workaround? - UPDATED 8th August

Click here to read the answer

Fix not, workaround yes: Affected apps can still be unlocked via PIN/password, which is by default configured as a fallback option in any context that makes use of the fingerprint sensor. In addition, we are offering affected users the option to continue using Android 11 until Google stops supporting this operating system in early 2024.

If you are already on Android 13, please follow the instructions here to revert to Android 11. This will allow for you to go back to using your fingerprint sensor with secure apps.

Please beware! Following these instructions will mean you will need to erase your data). If you have any issue doing this operation please contact our customer support.

(How) can I go back to Android 11 to get the functionality of the fingerprint sensor back? - UPDATED 8th August

Click here to read the answer

Going back to Android 11 will not solve this issue forever: Android 11 will eventually run out of security support early 2024. Apps with high security requirements won’t work anymore at that point – these will be more or less the same apps that require strong fingerprint security.

If you are already on Android 13, please follow the instructions here to revert to Android 11. This will allow for you to go back to using your fingerprint sensor with secure apps.

Please beware! Following these instructions will mean you will need to erase your data). If you have any issue doing this operation please contact our customer support.

If I manually downgrade to Android 11, will I lower the Security Patch Level of my device? - New! 8th August

Click here to read the answer

No, as both the latest software release based on Android 11 (4.A.0023) and the latest software release based on Android 13 (6.A.018) include the same Security Patch Level: 5th of June, 2023.

Also, Android 11 will receive bi-monthly security updates as long as it is supported by Android (probably early 2024). These updates, however, cannot be installed over-the-air but need to be manually flashed. Please follow the instructions here to revert to Android 11

If I downgrade to Android 11, will I receive a notification when a new bi-monthly Android 11 update is available (e.g with a new security patch)? - NEW! 8th August

Click here to read the answer

Unfortunately, no. It is impossible to technically differentiate if you willingly decide to stay on Android 11. You can expect a new Android 11 software update every 2 months here. You will get the news via our forum.

This also means that our update system will be proposing you to upgrade your device to Android 13, in case you change your mind and you still want to benefit from the latest Android features. You can dismiss this notification, and you will only see it at most every 2 weeks.

I use [alternative operating system] on my Fairphone 3/3+. Will this issue affect me as well? - Updated 8th August

Click here to read the answer

Contrary to what we communicated earlier, it is indeed possible to continue using the biometric login when using alternative operating systems (OS). This is possible because these OS do not have to undergo Google’s official approval process. However, from a security and privacy perspective, we cannot recommend circumventing these restrictions.

Which apps are affected by the issue? - Updated 8th August

Click here to read the answer

Since the issue is connected to the security certification of the sensor, the issue affects those apps with high-security requirements, such as banking apps. Our forum members have started to assemble a list of affected apps here, but there might be other apps affected, too. For nearly all of these apps, it is possible to log in using a pin or password instead of the fingerprint sensor. For the Austrian government application “Digitales Amt”, we have confirmed that login is still possible using a hardware key (see a list of compatible hardware here).

Previous FAQs - Published on 28th of July

What exactly is causing the issue with the fingerprint sensor?

Click here to read the answer

Due to updated test requirements, Fairphone 3’s fingerprint sensor is now certified at a lower security standard, according to Android’s security requirements. We cannot get an updated firmware from the fingerprint sensor supplier, in order to increase the level again. Android biometrics security requirements are continuously increasing to stay aligned with latest research in the field, for example on reproducing someone else’s fingerprint to log into their device and apps.

Could Fairphone have prevented this?

Click here to read the answer

We could have written the explanation proactively for the end users.

We are also having conversations with all our software and hardware suppliers to get their support for a longer time for our more recent products. On Fairphone 3, we unfortunately didn’t manage to have a long-term commitment from the fingerprint sensor manufacturer.

Why wasn’t this issue included in the release notes?

Click here to read the answer

We were aware of this issue before beginning the roll-out of the latest update, but failed to include it in the release notes. This is a major oversight and should not have happened. We realize that we need to be more proactive about how to communicate and present known issues/regressions and potential workarounds before releasing updates to the public. It is now clearly indicated in the release notes and in the update notification.

If Fairphone was aware of this, why did you choose to release the update, anyways?

Click here to read the answer

Some workarounds could be put in place, see the section “What do do for the affected users?”. This is not convenient for the users using the fingerprint sensor with some apps, but they can still use those apps, unlocking them via PIN/password. Android 13 provides many new perks and features that we hope will enhance your user experience and inspire you to keep using your Fairphone for as long as possible.

If the fingerprint sensor is certified as “weak”, does this mean it is not safe to use / wasn’t safe to use before the Android update? - Shortened on 8th August

Click here to read the answer

Android security requirements changed with Android 13, which require changes in the firmware of the fingerprint sensor. Because of the lack of this firmware update, the fingerprint sensor could not be qualified “Strong” anymore and “Strong” could be a prerequisite for some apps to use it, like the banking apps. Our fingerprint is now classified as Class 2 and you can find more information here in the Android Compatibility Definition Document (CDD).

Will the fingerprint sensor on the Fairphone 4 stop working as well, once the Fairphone 4 receives the Android 13 update?

Click here to read the answer

No, as the fingerprint manufacturer for the Fairphone 4 didn’t drop the support. We’re also already preparing now to avoid similar situations for Fairphone 4 as much as possible.

19 Likes
348

Just to make it explicit: people who stay on Android 11 will not be able to install the bi-monthly security updates over-the-air (OTA) but have to use the manual installation method.

Which means for people who haven’t updated to A13 yet (and reverted back to A11 the way described above) and simply stayed on A11 for now, they’ll have to unlock the bootloader (and wipe their data in the process) to install the updates, right?

Update: A11 updates can be installed via sideload without wiping the data :partying_face:

7 Likes
349

Because of the lack of this firmware update, the fingerprint sensor could not be qualified “Strong” anymore and “Strong” could be a prerequisite for some apps to use it, like the banking apps. Our fingerprint is now classified as Class 2 and you can find more information here in the Android Compatibility Definition Document (CDD).

So if you can’t update or repair it > It’s not yours.
And it’s not open.
It’s against longlivety and failed to be sustainable.

This should be improved, intentional.

2 Likes
350

Write those who are responsible (=the supplier of the sensor), venting here will not help to change this.

1 Like
351

Has it? I’ve been clicking ‘check for updates’ every day for two weeks now, because I want to add a few more apps to the app fingerprint support status wiki page, but it still says ‘Android 11, no updates available’.

352

Sadly, I don’t think there is any real way of improving this. The firmware suppliers only support the devices for x years and that’s unlikely to ever change.

The issue also boils down to cost, as mentioned before. The FP3 is ancient compared to most phones, and any larger amounts of components are unlikely to sell.

FP definitely messed up, but not being able to replace a ~4 year old component is completely understandable IMO.

1 Like
353

FP definitely messed up, but not being able to replace a ~4 year old component is completely understandable IMO.

I don’t entirely agree with this statement. That would be fine in general, but not when you’re advertising with longevity and environmental friendliness. If you get your sales by making a promise then you have to deliver on the promise and ~4 years is far from the expected lifespan of the device.

If you look at it from an economic point of view then while it doesn’t make sense to replace it, then again that would mean that they never intended to deliver on their promise and that would be false advertising and a big no-no.

5 Likes
354

The phone is still working, even with current software updates, so where is the promise, that wasn’ t fulfilled?

4 Likes
355

Longevity means being able to use it as intended for a very long time. This includes the fingerprint sensor, which is no longer 100% functional. If my phone broke down to the point where I could only make and receive calls, it would still technically be functional, but it would no longer be possible to use it as intended. As long as all original functions are still present or replaced with an equivalent or better solution, the smartphone is 100% functional. Longevity is the length of time that the device works 100%, not 50%, 80%, or even 99%.

For me, not getting security updates is not an option for security reasons, nor is not having a strong fingerprint sensor. For me, a smartphone works as long as I would be willing to buy it again with the current features (at a cheaper price, of course). That’s not the case, I wouldn’t use a smartphone without a strong fingerprint sensor, even if it were free.

1 Like
356

That’s your opinion. But for sure the phone is not nonfunctional or unusable. A lot of people don’t use the fingerprint sensor at all for safety reasons.

It’s of course always a pity, if something, you are used to is not working completely anymore. But blaming Fairphone for not holding promises is just inappropriate. Nobody could even think of this possibility, when the development of the device started, maybe five years ago.

5 Likes
357

Do you know your fingerprint reader was already unsafe before the Android 13 upgrade ? The only thing that has changed is that now apps have the information.

2 Likes
358

First things first, they said they tried to secure a long-term support contract with the fingerprint sensor supplier, but couldn’t. So they knew it could be a problem. So what you are saying is obviously wrong.

What would you suggest as an objective measure of the phone’s functionality? 90% functional? 50% functional? And what percentage do you lose from a dead battery, or in this case a sensor? The only objective way of measuring is 100%. Everything either works as intended or it doesn’t. My car doesn’t work properly, if the headlight doesn’t work, even if I could drive it perfectly during the day.

What I find inappropriate is your statement. As you said, it’s my opinion and I feel like they haven’t kept their promises because I can’t use my phone as intended after maybe half of its lifespaneven though it was advertised as having longevity. And you believe you have the right to tell me my feelings are “inappropriate.” Why? Don’t you think you’ve crossed a line? If you don’t share that feeling, that’s fine, but your statement isn’t okay at all.

@Alain_Guillet
Technically you are right. The sensor’s firmware no longer provides strong security.
But 1.: No security is secure forever. It’s a constant struggle. No encryption currently in use can withstand a quantum computer. Although ciphers exist that can do this, they are still under development and are not used. So what you say is true, but it applies to everything and at all times.
2nd: Other manufacturers have older phones with still strong fingerprint sensors, so they could have been prepared for that (choose sensor with better security or longer support). If a long-term support contract could not be secured with the supplier, they could have contractually agreed to receive the firmware source code after support expired (not an uncommon contractual clause) or altered the construction of the phone to make the sensor easily replaceable and to use the 4 years to find a way to get a better sensor as a replacement option. While I see no willful lying in this, I do see unacceptable negligence (at least for me it’s unacceptable. to each their own opinion).

1 Like
359

Not at all. I never said, that your feelings are ‘inappropriate’, and you were never talking about them, But you said:

That is just accusing a company that they are betraying, and that is for sure inappropriate in this case.

Don’t call me a liar. Even if it was clear at the beginning of the development, that there will be no firmware support for the fingerprint sensor after probably three years. It wasn’t foreseeable that it means that Google down-rates the sensor now.
The consequence would have been to build a phone without a fingerprint sensor ‘for longevity reasons’.

4 Likes
360

Except for Apple, that can easily put pressure on its providers because they sell a millions of phones every year, I don’t know another company that made 4 upgrades of the OS (from Android 9 to 13) for a phone out in 2019. The Samsung Galaxy S10, released in 2019, stopped at Android 12 for example.

3 Likes
361

Okay, step by step, because I feel like we’re talking past each other.

They knew this could become a problem. They took the risk, most likely for cost reasons. They didn’t know when it was going to happen, but they knew it was going to happen, maybe in three years, maybe in 15 years (Google is constantly evolving the definition of safe). If you choose to take a risk, you are responsible for taking the fall or you choose not to set expectations of longevity. At the moment I don’t feel that they take responsibility for their decision. While this would be fine if the problem was unsolvable, I don’t think it would be fine if they didn’t solve it just because it would cost them money. You take the risk, you take the fall. Because of this, I dismiss economic reasons and I believe that if they didn’t solve the problem just for economic reasons, they would break their promise. If I didn’t make that clear enough before, I apologize.

Being wrong and lying are two completely different things. I have never called you a liar and I would never call you a liar and I would ask that you refrain from making such accusations.
As mentioned earlier, the definition of safe is constantly changing. There were better sensors and they decided against it. foreseeable now => no. foreseeable at all => yes. They had options and while I don’t blame them for their choices, right now I blame them for not taking responsibility (maybe that will change, who knows).

@Alain_Guillet
I can’t disagree. Some older and cheaper phones managed to still have security updates (A12+) and a strong fingerprint sensor. So it would have been possible, but it didn’t happen. When a company advertises longevity, I expect them to intentionally perform in a way that other companies “accidentally” perform. Nothing more, nothing less (okay more would be nice, but it’s not a must).