I recently started using a mobile wallet, and it requires me to enable a screen lock for the entire phone. I understand that this improves security, but why can't an app use the phone's biometric hardware and secure elements directly, then require authentication only when that particular app is opened? My understanding is that biometric sensors are isolated from the main operating system and communicate through protected hardware such as Titan M or Secure Enclave. Couldn't the operating system provide a secure API allowing individual apps to configure their own lock requirements?
2 Answers
A full-device lock protects much more than one app. If the phone is lost, the lock helps protect stored data, authentication tokens, payment credentials, and other apps before the device is unlocked. An app-specific lock would leave the rest of the phone exposed and could also be bypassed by launching another component, reading notifications, using backups, or exploiting accessibility and screen-sharing features.
Apps can request biometric authentication through system APIs, and some apps do use Face ID or fingerprint authentication when they open. However, that is usually an extra check on top of the device’s security rather than a replacement for it. Wallets also need the phone itself to have a secure passcode or pattern because the device credential protects encryption keys and provides a fallback when biometrics are unavailable.
The important distinction is that an app can ask the operating system to verify the user, but it does not get direct access to biometric data or control the secure hardware itself.
There is also a reliability issue: biometrics can be disabled temporarily after failed attempts, a reboot, or other security events. The device needs a passcode-based recovery method, and requiring a system lock gives every security-sensitive app a consistent foundation.