1 min readNov 14, 2016
I would not use the fingerprint to authenticate against a server. For that I’d use password or pin code. Depending on how much security you need in your app, a possible approach could be the following:
- authenticate the user using password or pin code (never store those on the device) against your backend server
- right after the user has been authenticated against your backend server using password or pin code, use fingerprint to create a key and bind it to the fingerprint authentication.
- from that point onwards, use fingerprint as long as your key is valid (no need to exchange anything with the server). The key will become invalid once a new fingerprint has been added, the device is rebooted, etc. At that point, repeat the process (authenticate against your server using password/pincode, re-create the key and bind it to fingerprint authentication)