-5

I am working on a project to use fingerprint to authenticate the user. I don't want the authentication to be device specific. Hence want to upload the user fingerprint to cloud.

I do understand that fingerprint can be considered to authenticate the user on device using :https://www.npmjs.com/package/react-native-biometrics which is a safer bet. But it doesn't serve the purpose.

I searched for fingerprint upload to cloud and i realized that it is not possible from this link: https://www.androidcentral.com/how-does-android-save-your-fingerprints#targetText=When%20you%20register%20a%20fingerprint,the%20data%20from%20the%20scan.&targetText=This%20encrypted%20fingerprint%20template%20is,on%20your%20phone's%20encrypted%20storage

However, this article is old! I need some input whether I can upload the fingerprint from the device to cloud (I'm planning to use EC2 instance for the backend API.) on enrollment and can be used to authenticate the user on accessing the application on any device.

Improve this question
1
  • Doing this would be a huge violation of user trust and would be highly unethical. Just because my device can collect a picture of my face or my finger, that doesn't give any application the right to upload it to a server without my permission. Commented Oct 15, 2019 at 1:58

1 Answer 1

Reset to default
1

I don't know the details for Android, but iOS will most definitely not allow you to directly access the fingerprint data, let alone upload it.

By handling all biometric encryption/decryption in a separate processor (the 'Security Enclave'), that data is basically locked down to the physical device.

To quote Apple Developer Documentation:

To maximize security, your app never gains access to any of the underlying authentication data. You can’t access any fingerprint images, for example.

Improve this answer
1
  • The only operations an iOS application can do: Encrypt data using the fingerprint sensor and store the encrypted data in the Secure Enclave until removed, and decrypt data that is stored in the Secure Enclave and deliver the decrypted data to the app. Both operations require the user to use biometric authentication or to enter the device passcode. Commented Oct 13, 2019 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.