11

As in title, what are the conditions? (fingerprint isn't enough to unlock the device, one needs to enter PIN. I am not talking about the requirement after a re-boot)

I can't seem to discern a pattern, on some days I get this security warning at least 3 times, and on some days never or maybe once, while the usage pattern seems to be similar.

Pixel 4a, Android 11

4
  • Time should be one factor, but I could imagine that the recognized fingerprint accuracy is also considered.
    – Robert
    Sep 14, 2021 at 10:29
  • That code should be located in the Gatekeeper component that runs in the Trusted Execution Environment (TEE) of the ARM CPU.
    – Robert
    Sep 14, 2021 at 11:55
  • 1
    I am not sure in what form AOSP contains the gatekeeper code. I would assume that it is present as signed binary blob for TEE execution but my guess is that the source code is also available. But I have never worked with code of Android that runs in TEE.
    – Robert
    Sep 14, 2021 at 13:54
  • 4
    Ugh, I got lost when trying to browse the source code because it branches to too many classes, and yet I haven't reached the conclusion. At the very least, I found a maximum of 72 hours (3 days) for the timeout, but that's only the tip of the iceberg...
    – Andrew T.
    Sep 14, 2021 at 20:57

1 Answer 1

6
+50

This is triggered by fallback timeout as stated by Andrew T. Android enforces tiered authentication model backed by Trusted Execution Environment (TEE) to authenticate the user. Primary tier authentication is your screen lock code which has the highest level of security and is cryptographically bound to storage encryption. Secondary tier is biometrics and tertiary tier is Smart Lock's Trusted Devices that are only available when the device is in After First Unlock (AFU) state.

After every 72 hours or 3 consecutive failed biometric authentication (whichever happens first), TEE falls back to screen lock code if the biometric sensor is a Class 3 biometric (formerly Strong). For Class 2 (formerly Weak) and Class 1 (formerly Convenience) biometric sensors, fallback timeout is even smaller, with reduced security features and with idle timeout constraint. Tertiary tier authentication has the smallest.

Constraints that reflect the length of time before a biometric falls back to primary authentication

Smart Lock's Trusted Devices cannot unlock the device. They keep the device unlocked for maximum of 4 hours. That is after 4 hours, the device will prompt you to use either screen lock code or biometrics which then resets the timer for smart lock.

You can also manually trigger fallback to screen lock code using lockdown option in power menu (enable it in settings) that temporarily disables Smart Lock, biometrics and notifications on the lock screen until next unlock.

Note that these features including lockdown mode (in both android & iOS) do not increase your data security. They only make it harder for the attacker to spoof weaker lock mechanisms within a time limit. For example, cloning your fingerprint and 3D printing your face have to be done within 72 hours (or 24 hours) from the time of last primary tier authentication. For these features to work, your device should be already in after first unlock state. In this state, the encryption keys that decrypt your storage are already in alive state. By using custom engineered forensic tools and OS kernel level exploits, your data can still be decrypted without unlocking your screen.

While such attacks are even harder than spoofing biometrics, they are not impossible. Spyware agencies have been decrypting data of seized devices from long time because most of the time the devices they get are in AFU state. The safest state (but not immune) for the device to be in is Before First Unlock (BFU) state in which TEE awaits for primary tier authentication to release encryption keys so the attack vector is shifted on exploiting weaknesses in TEE which further increases the difficulty to compromise data.


Lockscreen and authentication improvements in Android 11

Measuring Biometric Unlock Security

After First Unlock: Device has been unlocked once since last reboot.

Before First Unlock: Device has not been unlocked once since last reboot.

8
  • 3
    I misunderstood earlier but on reading the linked documents again, I am still not sure why can't seem to discern a pattern, on some days I get this security warning at least 3 times, and on some days never or maybe once, while the usage pattern seems to be similar
    – beeshyams
    Nov 11, 2021 at 16:28
  • Have you tried Pixel fingerprint calibration tool?
    – defalt
    Nov 11, 2021 at 16:52
  • If you are talking about this, it is for Pixel 6 under the screen scanner. Never heard of it and this is what search says. //google.com/amp/s/m.gsmarena.com/… did you mean something else? //edit :Broken link //google.com/amp/s/m.gsmarena.com/…
    – beeshyams
    Nov 11, 2021 at 17:59
  • I'm not able to reproduce it. You should keep the question unanswered so that someone else might document and answer the behaviour. In your case, It doesn't seem like routine fallback.
    – defalt
    Nov 11, 2021 at 18:11
  • 1
    In Pixel and mostly flagships in general, they come with class 3 biometrics.
    – defalt
    Nov 14, 2021 at 0:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .