使用 Firebase 进行指纹身份验证

Question

I want to develop an app that uses fingerprint authentication with firebase (Android and IOS) what I want is the authentication to take place on the firebase Database not on the phone it self(so the user's fingerprint Id must be stored in firebase) is there anyway to do it ? the fingerprint scanner does generate a unique ID for scanned fingers ?if yes can you provide me with Java code to it? Thank you

Answer 1

the fingerprint image nor its features are accessible by the API. From android website:

Thus, raw images and processed fingerprint features must not be passed in untrusted memory. All such biometric data needs to be secured within sensor hardware or trusted memory. (Memory inside the TEE is considered as trusted memory; memory outside the TEE is considered untrusted.)

Answer 2

The Web Authentication API (also known as WebAuthn) is a new web specification written by the W3C in 2019.

https://webauthn.guide/

It allows for passwordless authentication using biometrics (FaceID, fingerprints, Windows Hello, etc).

It is probably not a perfect solution for you as it does not necessarily fit into a Firebase world exactly, but with some custom backend code you can probably get it to work.

Answer 3

• Fingerprint data of any kind must not be backed up to any other source, including the cloud or your computer or any application
• Fingerprint authentication must be used by the process that requested it ( no sharing of any fingerprint data, even just the yes or no answer to see if it was correct )

TEE stands for Trusted Execution Environment

Source: Android Central ( https://www.androidcentral.com/how-does-android-save-your-fingerprints )