I recently started using Google Wallet, and it requires me to enable a screen lock on the entire phone. I understand that payments need strong security, but why can't an app simply use the phone's secure biometric hardware through an API and protect itself independently? My understanding is that biometric sensors are isolated from the main operating system through components such as Titan M on Google devices or Secure Enclave on Apple devices. Couldn't apps be allowed to request biometric authentication and enforce their own security settings without requiring a full-device lock?
2 Answers
Apps can usually request biometric authentication, but that is different from establishing a secure device lock. A full-device lock protects the phone before the operating system and apps are fully available, helps secure encrypted storage, and provides a trusted fallback such as a passcode. An individual app generally cannot guarantee those protections for the whole device or prevent its data and authentication keys from being exposed through recovery, backup, debugging, or an unlocked system.
Payment apps have stricter requirements because access to the app is not the only concern. The device needs to have a trusted lock state so payment credentials and cryptographic keys are protected even when the app is not open. Requiring a system passcode or equivalent also gives the OS a consistent way to lock the device, invalidate biometric access after a restart or failed attempts, and protect other apps and services.
Some apps do offer Face ID or fingerprint prompts, especially for convenience. Those prompts protect only that app, though; they do not provide the same guarantees as having a passcode-enabled device, which is why wallet and payment features can still require the full system lock.
So biometrics can be used as an extra check inside an app, but they are not intended to replace the device-level security model. The operating system controls the biometric result and normally only tells the app whether authentication succeeded.