Biometric authentication

Security Mid-level Kotlin 2.0+ API 24+ Reviewed By Best Latest Apps

Pick the fix

An app shows BiometricPrompt and, on success, reads the token from plain storage. A security review flags it. Fix?

Options
Hint 1 of 1

What makes the result impossible to fake?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Encrypt the token with an auth-bound Keystore key and decrypt with the CryptoObject's cipher after success

Correct. Without real authentication, the key can't decrypt the token.

Why not the others?
  • B Show the prompt twice. Still just a UI gate.
  • C Use BIOMETRIC_WEAK. Weaker, and still not bound to crypto.
  • D Hide the token in a resource file. Anyone can read the APK.

30-second answer

Use BiometricPrompt from androidx.biometric. For real security, bind it to a crypto operation: create a Keystore key that requires authentication, pass a CryptoObject with a cipher to the prompt, and use the unlocked cipher only after success. A prompt that just returns 'success' without crypto can be bypassed on a compromised device.

Practise saying it · 30 s. No recording, just a timer

Explain secure biometric login.

Say your answer out loud, then check which of these points you covered:

  • BiometricPrompt
  • CryptoObject with auth-bound key
  • BIOMETRIC_STRONG
  • Fallback and invalidation

Deep dive

BIOMETRIC_STRONG (Class 3) is required for crypto-bound keys.

DEVICE_CREDENTIAL allows PIN or pattern as fallback.

Check BiometricManager.canAuthenticate() first and handle no enrolment.

Handle KeyPermanentlyInvalidatedException by asking the user to sign in again.

Common mistakes

  • Treating the success callback alone as proof.
  • Using BIOMETRIC_WEAK for crypto.
  • No fallback when biometrics aren't enrolled.

Senior take & follow-ups

Stress the CryptoObject; that's the difference between a UI gate and real security.

Follow-up questions

Think of your answer first, then open the hint.

  1. Why bind to a CryptoObject?

    Show hint

    The key only works after real authentication, so the result can't be faked.

  2. What does Class 3 mean?

    Show hint

    Strong biometrics with low spoof rates, allowed for Keystore keys.

Compare on iOS: Face ID and Touch ID done securely Same idea; iOS binds Face ID to Keychain items with access control.

Related questions

Suggest a fix if something here is wrong or out of date.