I got myself a Nexus 6P with a fancy fingerprint scanner. So far I'm a bit reluctant to use it because I can't find any info on how Android Marshmallow stores those fingerprints. Are they hashed (as SHA2 or whatever), or are they in they stored in the clear? Is the fingerprint data kept on the device, or does it get sent up to the cloud?
Looks like the answer is in Google's Android 6.0 Compatibility Requirements, section 7.3.10:
- MUST have a hardware-backed keystore implementation, and perform the fingerprint matching in a Trusted Execution Environment (TEE) or on a chip with a secure channel to the TEE.
- MUST have all identifiable fingerprint data encrypted and cryptographically authenticated such that they cannot be acquired, read or altered outside of the Trusted Execution Environment (TEE) as documented in the implementation guidelines on the Android Open Source Project site [Resources, 96].
- MUST prevent adding a fingerprint without first establishing a chain of trust by having the user confirm existing or add a new device credential (PIN/pattern/password) using the TEE as implemented in the Android Open Source project.
- MUST NOT enable 3rd-party applications to distinguish between individual fingerprints.
As far as I understand it, the fingerprints are not backed up in the cloud - if they were, I'm sure someone would have noticed it and written an article on it and calling it a huge security risk as if hackers get your personal data, they'd have your fingerprint too. The security method I'm not sure about, but I doubt it would be left unencrypted - that would pose a security risk, however even if it was left unencrypted it would be very hard to actually access it (but most likely not impossible).