4

In my project, we're adding this biometric authentication feature using BiometricPrompt. The biometric can be enabled in the app's settings but the app also needs to display if face biometric is supported on the user's device.

Based on my research, the official way of checking if an android device has face biometric is through this code below:

val hasFaceBiometric = packageManager.hasSystemFeature(PackageManager.FEATURE_FACE)

However, this check seems to be unreliable as it only returns true on Google Pixel 4. I tested our app on Samsung Galaxy S9 and S10 and they both seem to support face biometric but the weird thing is, the code above returns false.

With the current state of face biometric in android, is there really a reliable way to check face biometric support?

Jerome Franco
  • 43
  • 1
  • 3
  • FEATURE_FACE is added in API Level 29 are you sure you are using API level 29 or above ? in Samsung devices that you are using to test ? – AgentP Jul 04 '20 at 13:23
  • 1
    Yes, the samsung devices were running on android 10. I also tested it on Note 9 running on android 9. – Jerome Franco Jul 04 '20 at 14:50

1 Answers1

3

The face recognition from Samsung is using the front camera which is not considered a secure biometric. This is what the docs say:

Feature for getSystemAvailableFeatures and hasSystemFeature: The device has biometric hardware to perform face authentication.

What I'm assuming is this will check if the device has secure face recognition, which the Pixel 4 has. From Android 10 and up (Pie had an issue which somewhat enabled unsecure biometrics in the API) Samsung will never show the BiometricPrompt for face recognition. If they provide a secure face recognition in a future device this check will probably return true.

Kevin van Mierlo
  • 9,554
  • 5
  • 44
  • 76
  • As for now I'm using the `BiometricPrompt` on Samsung S10+ for face recognition. However it is necessary to [setAllowedAuthenticators](https://developer.android.com/reference/androidx/biometric/BiometricPrompt.PromptInfo.Builder#setAllowedAuthenticators(int)): `promptInfo = new BiometricPrompt.PromptInfo.Builder().setAllowedAuthenticators(BiometricManager.Authenticators.BIOMETRIC_WEAK);` On the other hand I did not found any way to check if exactly Face recognition is available. – Roman Pavlov Dec 01 '20 at 10:35
  • Like I said, Samsung is using the front camera for face recognition and therefore is not secure. This is why you have to specifically set it to `BIOMETRIC_WEAK`. If you use `context.getSystemService(BiometricManager::class.java)?.canAuthenticate() == BiometricManager.BIOMETRIC_SUCCESS` it also checks the weak authenticators which I found out the hard way. Since Android 11 the same method is available, but you can pass Authenticators in there. However I'd advice not to use this as this is not secure at all! Always use strong biometrics unless you have a good reason to use this. – Kevin van Mierlo Dec 01 '20 at 11:33