Here you go. htc stored unencrypted fingerprint images as a world-readable file on phones. On the HTC One Max X the fingerprint is saved as /data/dbgraw.bm

Here you go. htc stored unencrypted fingerprint images as a world-readable file on phones. On the HTC One Max X the fingerprint is saved as /data/dbgraw.bmp with a 0666 permission setting (world readable). Any unprivileged processes or apps can steal user’s fingerprints by reading this file. Particularly given Google's (charitably), well, lax supervision of what apps that make it into the play store do, this is amazing. Also, even when you're not dealing with incompetent morons at htc, the same article points out that on other Samsung and HTC devices, any app can directly query the fingerprint sensor. Samsung and HTC appear to be strictly amateur hour. After stuff like this, how can you trust what an Android phone is doing with your fingerprint? http://www.theguardian.com/technology/2015/aug/10/htc-fingerprints-world-readable-unencrypted-folder http://www.theguardian.com/technology/2015/aug/10/htc-finger...