Aitor Viana
1 min readNov 14, 2016

--

I would not use the fingerprint to authenticate against a server. For that I’d use password or pin code. Depending on how much security you need in your app, a possible approach could be the following:

  1. authenticate the user using password or pin code (never store those on the device) against your backend server
  2. right after the user has been authenticated against your backend server using password or pin code, use fingerprint to create a key and bind it to the fingerprint authentication.
  3. from that point onwards, use fingerprint as long as your key is valid (no need to exchange anything with the server). The key will become invalid once a new fingerprint has been added, the device is rebooted, etc. At that point, repeat the process (authenticate against your server using password/pincode, re-create the key and bind it to fingerprint authentication)

--

--

No responses yet