Biometric Authentication on Mobile

Instructions

Biometric auth on mobile is only meaningful when it is bound to a cryptographic operation. A biometric prompt that merely returns true can be bypassed by a patched binary.

1. Threat Model

Biometrics protect against:

• Casual device sharing.
• Lost / stolen devices where the PIN is strong.
• Local attackers without the user's finger/face.

Biometrics do not protect against:

• A compromised app process (same binary asking for biometry).
• A coerced user.
• Fingerprint false accepts on cheap sensors (rare but non-zero).

2. Android: BiometricPrompt (Class 3 / Strong)