Screen with fingerprint sensor

[patata]

I wish my next screen could unlock with my thumb, so that i don’t have to hide my screen from nearby people every time i want to unlock it.
Is there any future plan for it?

[chrisse]

Hi,
You can hide your pattern:
Settings / Security & privacy / Screen lock (click on the settings icon)
Then you can turn off Make Pattern Visible (On Lineage you can also disable show pattern error).
Does it help or did you have another screenlock type?

[patata]

This is done already, but I still have to tap the screen. I was hopping that one day a screen with fingerprint sensor would be manufactured…

[paulakreuzer]

Personally I don’t think it’s likely that FP will go that way. Many vocal FP users are very privacy minded, so they reject a security risk like a fingerprint sensor.
If someone stole your phone all they had to do is find a fingerprint on the glass of your screen and already they can 3d print a finger to unlock your phone.
Not to mention a scanned fingerprint is just more personal data that the big companies and government agencies will be able to collect through your phone.

PS: Also check out this old topic:

Fingerprint sensor for the FP2 feasible?

I’ve recently had a similar thought. However after looking into it, I’m not sure whether this is feasible anymore. [Android Compatability Definition (pdf, p 48)][1] lists a requirement which might be hard to meet with an aftermarket fingerprint sensor in the back cover: MUST have a hardware-backed keystore implementation, and perform the fingerprint matching in a Trusted Execution Environment (TEE) or on a chip with a secure channel to the TEE. I’m not an expert though and might be complet…

[Roboe]

@paulakreuzer

they reject a security risk like a fingerprint sensor.

Main security issue with fingerprints (and other biometrics) is that you can’t change your fingerprint. You can change a password or a cryptographic key, but once your fingerprint is compromised, you’re screwed. Specially when your fingerprint is not just a password but also your identity online (check out India’s Aadhaar, e.j.).

[patata]

The people around me can easily see my pin or patern while i put it in, so the risk of having my fingerprint stolen is low, compared to this.

Can you please explain how big companies still have access to a Fairphone Open, with apps from the F-Droid exclusively ? (No google, no fb, only pure FOSS).

[Roboe]

@patata

only pure FOSS

Userspace may be FLOSS, but BLOBs are present and low-level software (firmware) is dark and closed too (e.j. radio firmware for the SoC is a whole different OS that runs in paralell, with low-level access to practically everything, connectivity and storage). So no “pure” here.

Sure, you (we) have less attack vector surface, though.

[JeroenH]

Theoretically, you could have either:

1. 2FA (PIN plus fingerprint)

2. Use fingerprint by default unless you’re in a situation of duress.

#1 isn’t possible with Android AFAIK, but it is with Linux and PAM and it shouldn’t be difficult to implement I suppose.

#2 is what Apple does with FaceID, and Android Pie (9) allows to disable fingerprint sensor as well.