Login to server using fingerprint

0
votes

I'm trying to authenticate users to the backend server using fingerprint.

The scenario that I can think of is when user registers with a new account, I should send some sort of a unique identifier to the server related to the fingerprint..

Later the user can send only that unique id to the server to log in with no passwords or emails or any other credentials..

Is that possible? If so, how?

1
androidauthenticationfingerprint
One possibility: When the user registers their account you create an asymmetric keypair that requires fingerprint authentication and share the public key with the server. When the user wants to log in you send some value to the server that identifies the user's public key (e.g. a public key fingerprint). The server responds by giving you some data to sign. Then the user performs a fingerprint authentication, which allows you to use their private key to sign the data that you got from the server. And then the server verifies the signature. – Michael

1 Answers

0
votes

It is technically possible since it has been done.

As the user registers with or for a new account, you also enroll one or more fingerprints. To do that, a fingerprint scanner is required. (Note that the fingerprint image that the Android fingerprint reader captures, cannot be "taken" out of the phone. You need an external fingerprint reader.)

Also needed is some sort of SDK for extracting a template from the fingerprint image. (The template is close to what you might be calling the unique identifier, although it might not really be that unique.) The manufacturer of the fingerprint reader, usually also supplies the SDK. If they do not, you'll need a third-party SDK. One can search online for those.

The extracted template is stored on the server alongside other user data. At login, you extract a template from the same finger, transmit it to the server, and search amongst the previously enrolled templates. For that search (identification), you also need some SDK, or some sort of AFIS. There are commercial as well as free offerings (such as sourceAfis).

A better explanation is given in the Wikipedia article.