So i dug alot deeper into the biometric verification and found some things out. the biometric verification alone is practically useless. all it returns is a yes no answer and no real biometric data. if we use it alone anyone can easily spoof it. what i came up is this approach where we combine biometric check along with hardware attestion.Android attestation:
- Generate a play integrity token on the device with a hash consisting of the logged in user id (to prevent replay attacks)
- Send the generated integrity token to the server
- Server sends the token to google servers to verify it and decrypt the data
- at this point, theres something called integrity verdict on android phones.
- since android allows rooting, which basically grants u admin access to ur entire os.
