Why is fingerprint lock considered less secure than pattern lock on Nexus 5X?

Question

My Nexus 5X highly recommends to set up pattern lock in addition to fingerprint lock, and the pattern is asked upon every reboot. And my password manager (KP2A) recommends to use fingerprint unlock only to "quick unlock" after a short period of inactivity, but to require full password for the DB after every reboot.

Hence two questions:

1. Why does Google considers the fingerprint lock as less secure than pattern lock?

   Using your fingerprint to unlock your device may be less secure than a strong password, PIN, or pattern.

2. For my password manager on Android, is it really much safer to re-enter password upon every reboot rather than to use fingerprint lock? How many bits my password should have to be more secure than fingerprint lock?

Please note that I'm asking specifically on fingerprint scanner implementation in 5X, not for a general theory on an average abstract fingerprint scanner solution.

Answer 1

The weakness is actually in the fingerprints themselves and not the way Nexus 5x implements it.

Fingerprints are less secure because they cannot be changed like a password and cannot be revoked if compromised.

Fingerprints are also left everywhere such as, at a glass. They can then be captured and reproduced. Think about this: Android uses a touch screen. The fingerprints are left on the screen after device's usage.

With a fingerprint it's almost good then it is good enough. Because the way it is touched or if you have a cut. Making fingerprints not hashable. Compared to a pin which has to be perfect every time.

They can be taken without permission. Not only from being left behind but also legally without consent. If a password is in your head it must be given, thereby, also leaving your right to privacy and your right to remain silent.

In the United States a person is also protected from testifying against themselves by the 5th amendment. Legally, fingerprints are considered as physical objects because they exist in the physical world. So they are not protected by the 5th amendment.

Answer 2

Certain fingerprint sensors are not very secure compared to patterns.

Why?

Because people have been able to hijack the fingerprint sensors! How? When you touch the fingerprint scanner, chances are you will usually touch it with the front of your finger. This leaves a fingerprint. A few hours later, say, you get a text, so you put your finger to it again to unlock it. This process repeats, and although you don't notice it, you have put several angles of your fingerprint on the sensor, because it is impossible to get your finger in the exact same spot every time. If a hacker stole your phone, he could use a high-resolution camera or even a scanner, for that matter, to read what is on the sensor. It will sense all the different angles and how they are aligned. Now, the hacker can print these patterns on a paper, and using one of the many established ways, make the ink conductive. He touches it to the fingerprint sensor and BOOM! Your phone has been hacked. And since there are fewer orientations of where your finger could be than possible pattern combinations, he could just try anther one if the previous didn't work. The worst part is, once he has this copy, He can hack any other device you purchase, as long as it has a fingerprint scanner. A pattern however is more secure. According to my calculations, there are 1000000000 (one billion) different possible patterns.

There is a grid, 3x3, and therefore there are 9 dots. Each dot could be the first, second, third, fourth, fifth, sixth, seventh, eighth, ninth, tenth, or not be touched at all. That's ten different options for 1. But we have 9, so number of combinations is 10 to the ninth, which is 1000000000.

Hope this helps.