github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-17 18:43:11 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

[Android] Fingerprint not linked to account, Fingerprint unlocks every logged in account #1125

New Issue
Closed
opened 2025-11-26 22:39:43 -06:00 by GiteaMirror · 1 comment
GiteaMirror commented 2025-11-26 22:39:43 -06:00
Owner
Copy Link

Originally created by @thomiczecks on GitHub (Oct 21, 2020).

Describe the Bug

The fingerprint of person A can unlock the vault of Person B if B only locked the vault and did not sign out. This bug (feature?) is closely related to #666. The fingerprint/biometry settings should be registered with each account and not system wide.

Steps To Reproduce

  1. Login in as person A, enable biometry unlocking and register fingerprint of person A
  2. Log out
  3. Login as person B and lock the account
  4. Unlock using fingerprint of person A

Expected Result

Unlock should fail because B's account is active.

Actual Result

Person A can unlock Person B's vault.

Environment

  • Device: Moto g6 plus (XT1926-3)
  • Operating system: Android 9, Patch date 01.05.2020
  • Build Version: 2.6.1 (3178)
  • Is this a Beta release? N
Originally created by @thomiczecks on GitHub (Oct 21, 2020). ## Describe the Bug The fingerprint of person A can unlock the vault of Person B if B only locked the vault and did not sign out. This bug (feature?) is closely related to #666. The fingerprint/biometry settings should be registered with each account and not system wide. ## Steps To Reproduce 1. Login in as person A, enable biometry unlocking and register fingerprint of person A 2. Log out 3. Login as person B and lock the account 4. Unlock using fingerprint of person A ## Expected Result Unlock should fail because B's account is active. ## Actual Result Person A can unlock Person B's vault. ## Environment - Device: Moto g6 plus (XT1926-3) - Operating system: Android 9, Patch date 01.05.2020 - Build Version: 2.6.1 (3178) - Is this a Beta release? N
GiteaMirror commented 2025-11-26 22:39:44 -06:00
Author
Owner
Copy Link

@mpbw2 commented on GitHub (Oct 21, 2020):

The pattern you're describing isn't possible with the way biometrics are implemented on the system. Applications do not receive unique information about fingerprints, only a "yay-or-nay" message upon validation/failure. Operating systems do this to protect your biometric data.

@mpbw2 commented on GitHub (Oct 21, 2020): The pattern you're describing isn't possible with the way biometrics are implemented on the system. Applications do not receive unique information about fingerprints, only a "yay-or-nay" message upon validation/failure. Operating systems do this to protect your biometric data.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#1125
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?