Implementation of Android Fingerprint technology [closed]

Question

I'm currently doing a web based system for multiple organizations, so on my login form, there's 3 simple field:

1. Company code, such as CNN (this is implemented so we can have same username, as long as they work in different company)
2. Username, such as James
3. Password

Now we are actually studying on the fingerprint authentication technology, on how it could help above.

Our assumption is below:

1. On our app, we provide a user registration screen, instead of username/password, they tap their thumb on the form, so we can get something, maybe a lengthy random string, which represents the thumbprint, then we pass this code to server, along with his profile, and registration completes.
2. Above repeats for thousands of our other users.
3. A user came to our app login screen, we show them a scanner, they put their thumbs on it, we send the retrieved fingerprint code, and send to server for a matching comparison, then we authenticate this user.

But from what we studied, it seems that the fingerprint SDK doesn't works this way. It simply authenticate if the user is the owner of the phone and it does not provide us a code or something to represents the fingerprint.

Can anyone with experience in developing a working/deployed fingerprint app, share with me how does fingerprint helps in authenticating your user?

Answer 1

As you discovered, the fingerprint only lets you verify that the user is the 'owner' of the device. It's therefore only useful if you expect each user to have a separate device, or at least have a separate Android login.

If the users do have separate devices then when the fingerprint check is successful you can get the device identification number, settings.secure.ANDROID_ID, and send that to the server. The server can use that (perhaps hashed) to look up the relevant user account.