Member Avatar for Toro_1

Hello! I have created a project on Android studio, and i use java as langage, i want to create a biometric system with fingerprint, what i mean is that i want to use android fingerprint device to get fingerprint id and store it in MySQL with some personal informations, so anyone can help me please
Thanks in advance

  • 4 Contributors
  • 6 Replies
  • 264 Views
  • 5 Months Discussion Span
  • Latest Post Latest Post by vincentlnalls

Dani AI

Generated

As wants to read a fingerprint "id" and store it in MySQL: Android does not expose raw fingerprint images or templates to apps. is right that the platform is intentionally designed to prevent exporting biometric templates, and 's privacy concern is sensible — biometric material must be treated as highly sensitive.

A secure, practical pattern is to keep biometrics on-device and store only a server-verifiable artifact. Common options:

  • Create a hardware-backed asymmetric key on the device that requires biometric unlock to use.
  • Send the public key (and attestation) to your server during registration and store that in MySQL.
  • For login, server issues a challenge; the device signs it after biometric confirmation; server verifies the signature. This is effectively a FIDO/passkey style flow and avoids ever storing fingerprint templates. As noted, you will also need a networking client (OkHttp or similar) and a server API to handle these exchanges.

Example workflow (pseudocode):

# Registration
keypair = generateKeyPair(requireBiometric=true)
public = exportPublicKey(keypair)
POST /register { userId, deviceId, public, attestation }

# Authentication
challenge = GET /challenge?userId=...
signature = signWithBiometricKey(challenge)   # shows BiometricPrompt
POST /verify { userId, deviceId, signature }
# Server verifies signature with stored public key

Example MySQL table to store non-sensitive artifacts:

CREATE TABLE device_keys (
  id INT AUTO_INCREMENT PRIMARY KEY,
  user_id INT NOT NULL,
  device_id VARCHAR(128),
  public_key_pem TEXT NOT NULL,
  attestation TEXT,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  last_auth TIMESTAMP NULL
);

Notes and cautions: never store raw fingerprint images or templates. Use TLS, limit retention, support device revocation, and provide a secure fallback (PIN/password). Also be aware of legal rules around biometrics (for example state or regional laws) and collect explicit consent if you handle anything biometric-related. This approach respects Android design and gives you server-side authentication without exporting sensitive biometric data.

Recommended Answers

All 6 Replies

Member Avatar for rproffitt

Doesn't that break security if you store your own fingerprint information?
I'm reading https://source.android.com/docs/security/features/biometric since it's a good project and primer on Android Biometrics.

biometric HAL guidelines to ensure that biometric data is not leaked and is removed when a user is removed from a device:

At first reading of your subject it appears you are attempting to break the basic security system.

commented: You mean, we should boot our phone before storing fingerprint id in external database? +0
Member Avatar for rproffitt

Sorry but I was unclear. If you read the article noted it notes that by design the systems do not allow storing the fingerprint in external databases.

Now it's quite possible you have your reasons to do this but the system is designed to stop you. The times I encounter folk that want to break the security like this often has them very upset they can do what they want to do.

-> Moving on. Since a smartphone is a personal device, why would we need the biometric data in the external database? It's not like it will be useful in other phones.

commented: The point is that i'm building this project to manage group of people in a company. I want their fingerprint store in external database in order to v +0
Member Avatar for rproffitt

I do have a background in the design and more for access systems such as what you might see at HID Global and more. I did design and coding for various surveillance equipment companies for many years.

But you are fighting a system that isn't supposed to allow export of the fingerprint data. As such you have chosen a dead end.

And then you write a comment but the sentence is cut off so I can't guess what you are trying to do. Try making a complete sentence so I can get a good grasp of what the project is about.

-> But let's also cover MDM which https://en.wikipedia.org/wiki/Mobile_device_management spells out well enough. If you are trying to make your own MDM then you have a few years to build such a thing (I hope!)

commented: Sorry! It was a network problem! I would say like, i want to store people fingerprint in order to control them especially employees in a company! +0
Member Avatar for rproffitt

You may want to do something but the stock fingerprint API (biometrics) doesn't appear to offer such.

If you did manage to get around all that, someone will report the exploit and soon, Google will patch it out.

However if you want to make your own Access Control system with the usual fingerprint readers such as https://www.ibm.com/docs/en/samfess/8.2.0?topic=authentication-integrating-digitalpersona-fingerprint-reader (one of dozens of readers out there) then you won't be fighting with the Android concepts of biometrics.

Member Avatar for macfan

Fingerprints (and other metrics) should be leak-proof. Thats basic security.

The hypocrisy of Google is horrendous, though. They say things likme biometrics should be leak-proof and at the same time they store this kind of data in least secure way possible.

Good riddance.

Member Avatar for vincentlnalls

You will need a OkHttp library and server side API to handle database operations. and some additions in AndroidManifest.xml file. thats a bit lengthy process i specific expert would more guide you better on this

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.