Is it possible to use "unlock with fingerprint" feature, and be asked for (after boot) giving passphrase and fingerprint on encrypted Galaxy S6

Question

I would like to purchase a Samsung Galaxy S6. One of the main reasons for the choice of device is the (apparently) good fingerprint sensor. I would like to / have to encrypt my phone (my employer requires this but, honstly, I would do it anyway) and I am very tired of typing my PIN every single time I want to unlock my phone. Hence a fingerprint sensor is a must-have on my next phone. Here are my questions Google could not answer for me:

1. Is it possible to use the "unlock with fingerprint" feature with an encrypted phone, or is this authentication method considered too weak? Strangely there is no information about that.

2. I would like the phone to behave in the following way (like an iPhone 6): After booting the device I am asked for my (potentially complicated) passphrase. After that I am allowed to use my fingerprints to unlock. After some time (configurable, maybe some hours?) I would be asked for the passphrase again.

   Benefit: Convenience through the fingerprint unlock, increased security because if somebody tried to force me to put my finger on the sensor (or had a rubber copy of my finger) it would still be no good on a freshly rebooted phone or after some hours.

   Basically this means having two unlock schemes configured at the same time, fingerprints and passphrase/PIN. Former would be used for convenience, latter for security. Putting in the passpharse a few times per day would be perfectly acceptable to me.

   Is this possible with a Samsung Galaxy S6 with stock ROM?

Answer 1

I found myself an answer to part one of the question: Yes, on the Galaxy S6 you can apparently use the fingerprint sensor to unlock the device after encrytion.

Infomation found here:

http://forum.xda-developers.com/galaxy-s6/help/fingerprint-unlock-device-encryption-t3081102

Has somebody something to say for part two? :-)

Edit 2015-10-06: I got my S6 last week. Here is the story:

• Encrypting the device and using fingerprint unlock does indeed work. :-)
• When configuring fingerprints you have to set a backup password.
• The backup password is used to encrypt the device's encryption key. --> Whenever you reboot the phone you must enter it. You cannot boot the phone using fingerprints alone.
• After a few unsuccessful attempts to unlock the device using the fingerprint sensor the device forces you to enter the backup password.
• I could not find some kind of timer to configure. If you want to force the input of the password you have to power down the device or use an unconfigured finger a few times in a row.

This is a near-perfect solution for me (except for the timer issue, but I can live without...).

Hope this information helps somebody!

Answer 2

The answer is it depends on the security policy settings deployed by your corporate IT. If you are giving corporate admin control over your device then their own security policies may require you to use a four digit pin or more complicated alphanumerical passcode and prevent you from using the fingerprint reader as a means for logging on the device (from a secreenlock).

If they also require full phone storage encryption you will have a separate password to use when booting the phone. You can not use fingerprints to authenticate on boot since the system hasn't booted at that point.

However, if your IT allows fingerprints to be used for lock screen authentication, then you will be able to use the fingerprint scanner to unlock the phone between uses. If the phone is turned off and back on, you would be prompted for the password that was set during the full storage encryption setup process and would then use your fingerprint for the lock screen until the phone is turned off and back on.