Fingerprint framework for developers

Feature Requests
1

There apparently isn’t any framework for apps to use the system fingerprint. This is quite handy (everyone knows the privacy concern, but let leave that to users to decide) feature for multiple different apps. One big one being for me personally BitSailor, where this has been achieved by doing custom hacking. I would like to see standard framework for apps to use the fingerprint used to unlock the system. Details about Bitsailor: BitSailor support thread - #185 by Rikudou_Sennin

11 Likes
2

Maybe it would be more useful/generic to have an API for system unlock.
This way people with fingerprint activated could use that and those without would use their security code without the application handling the various use cases.
On the principle however, I do agree that it would be very useful for some applications (password managers being the obvious case) to be able force an additional authentication before getting access to the content.
Obviously, it would be necessary to be able to link that to data access to prevent access through su-devel (the password database in this case).

2 Likes
3

There is. Sailfish Secrets.
Includes most of the other things you describe.

Also, AuthenticationPlugin has an interface for Fingerprints:

Sailfish::Secrets::AuthenticationPlugin::FingerprintAuthentication

4 Likes
4

Can that be used to pass the system fingerprint to the app?

5

Not an expert at all on Secrets, but if it did that would be a huge security gap would it not?

6

Well for that I’m not person to answer. I just know that it is nice to be able to use the system fingerprint inside native apps, like Bitsailor. For me it doesn’t matter (not enough knowledge) what is the standalone framework way to implement it, as long there would be some

7

I don’t know BitWarden or BitSailor.

But I imagine the workflow would be something like this:

  • Using Secrets API, generate a new secret/key, store it (in Sailfish Secrets).
  • Configure BitSailor to accept that secret to unlock whatever needs unlocking.
  • Using Secrets API, retrieve the secret using a request with FingerprintAuthentication

The user should then be prompted to scan their finger by the system, and if successful, BitSailor gets the secret/key and can unlock whatever.

1 Like
8

That’s exactly what I had in mind.
The application does not get access to the fingerprint but rather to the fact that system successfully identified the fingerprint.

From my point of view, it seems that everything is there already (now I need to dig deeper into using it).

I think the best choice for store applications would be Sailfish::Secrets::AuthenticationPlugin::SystemDefaultAuthentication as user would probably not want a specific authentication method (privacy concerns about fingerprint already raised, for instance).

9

Ah now I understand what @nephros tried to say… Yes, something like that, I didn’t meant that app would need to get the actual fingerprint, using Secrets API sounds logical

10

Well, what you’re describing is rather a workaround - it’s tied to having actual secrets. Sure, you could store a dummy value and fetch it using the fingerprint auth, but that’s not that great of a design.

Far from having a dedicated fingerprint api.