Thanks for filing this! It's in the go/fizz-features backlog but we've not yet prioritized it due to no developer requests.

That said, I've seen an increasing use of it on iOS lately so it may be time to start doing something. I've reached out to a couple folk for their thoughts, perhaps a good 2017 project!

Balazs - am I right in saying that when we ship WebAuthN that will include support for sites to use the fingerprint scanner?

You are correct that the long-term plan is to expose these devices through the WebAuthN API. More specifically, when calling the API to request an assertion, the relying party will have the option to require user verification [1], which can indeed be implemented through biometrics.

Note that, however, unless the fingerprint reader exposes itself as FIDO U2F or CTAP 2.0 authenticator, we will need to add some amount of logic in Chrome on each platform for each kind of biometric device.

1: https://www.w3.org/TR/webauthn/#enumdef-userverificationrequirement

> we will need to add some amount of logic in Chrome on each platform for each kind of biometric device

So, to be clear, if Android apps on a particular device support the fingerprint scanner (via the standard Android API), will it be supported by Chrome, with the same security properties?

Well, Chrome's support is completely independent of other apps' support for the fingerprint scanner. 

The WebAuthN API will support the use of creating WebAuthN credentials and assertions with the fingerprint scanner, with all the security guarantees that the WebAuthN API provides. I don't know that they are one and the same as those of the Android API.

In the case of Android, the logic in Chrome actually calls the FIDO2 GMSCore API, which does the actual interaction with the fingerprint scanner by treating the scanner as a CTAP 2.0 authenticator.

Kim, I'm assigning this to you, given this bug is Android-specific, and mark it as started, as you have started work on interfacing with the GMSCore API (in  Issue 678885 ).

Could you please update the milestone accordingly? (I'm not sure how soon the GMSCore API will be equipped to handle the fingerprint scanner.)

Yep, sounds good. And M69 is correct.