[Android] Fingerprint not linked to account, Fingerprint unlocks every logged in account

[thomiczecks]

Describe the Bug

The fingerprint of person A can unlock the vault of Person B if B only locked the vault and did not sign out. This bug (feature?) is closely related to #666. The fingerprint/biometry settings should be registered with each account and not system wide.

Steps To Reproduce

1. Login in as person A, enable biometry unlocking and register fingerprint of person A
2. Log out
3. Login as person B and lock the account
4. Unlock using fingerprint of person A

Expected Result

Unlock should fail because B's account is active.

Actual Result

Person A can unlock Person B's vault.

Environment

• Device: Moto g6 plus (XT1926-3)
• Operating system: Android 9, Patch date 01.05.2020
• Build Version: 2.6.1 (3178)
• Is this a Beta release? N

[mpbw2]

The pattern you're describing isn't possible with the way biometrics are implemented on the system. Applications do not receive unique information about fingerprints, only a "yay-or-nay" message upon validation/failure. Operating systems do this to protect your biometric data.