Google has added a small safeguard to the biometric authentication system on its Android operating system. Now, when an app on an Android device prompts the user for a fingerprint or face scan – for example, a banking app asking the user to log in – a small icon depicting the app will be displayed, to clearly indicate to the user which app is asking for authentication.
Presumably, this is meant to guard against any potential malware that might fraudulently prompt the user for authentication in order to gain access to an online account. If a rogue app attempts to authenticate using biometrics, the user can easily identify it because the icon of the suspicious app will be displayed, rather than the icon of a legitimate app the user intended to use.
While the Android platform has robust security measures in place, including sandboxing apps to prevent one app from accessing the data of another without explicit user permission, no system is entirely immune to security threats. The risk of such spoofing attacks on smartphones is generally considered low, especially with continuous security improvements and updates from platform providers like Google. However, the possibility exists, particularly with sophisticated malware or through the exploitation of system vulnerabilities.
The feature is now live in the beta preview for Android 14 QPR3, or “Android 14 Quarterly Platform Release 3”. It’s the third beta release of the upcoming Android 14 operating system, and it was launched on February 8, 2024.
In recent years, Google has significantly bolstered biometric security on the Android platform, showcasing a steadfast commitment to enhancing user privacy and security. The introduction of the BiometricPrompt API marked a pivotal moment, providing a unified and secure interface for all forms of biometric authentication across Android devices.
Moreover, Google’s implementation of hardware-backed security features, such as the Titan M security chip in Pixel devices, has further fortified the integrity of biometric data. This chip ensures that sensitive operations, including biometric verification, are executed in a secure and isolated environment, thus significantly mitigating the risk of unauthorized access.
Most recently, Google has been promoting the use of passkeys to replace passwords with biometric authentication or PIN-based two-factor authentication on a user’s smartphone.
Source: 9to5Google
–
February 9, 2024 – by the Mobile ID World Editorial Team
Follow Us