Let' s first take a look at the effectiveness of biometrics
Biometrics technologies are evaluated on three basic criteria:
The false reject rate
Percentage of authorized users who are denied access;
False accept rate
Percentage of unauthorized users who are granted access;
Crossover error rate
The level at which the number of false rejections equals the false acceptance.
Among all possible biometrics, only three human characteristics are usually considered truly unique:
Fingerprints, retina of the eye, iris of the eye
The crossover error rate is the point at which false reject and false accept rates intersect, it's the possibly the most common and important overall measure of accuracy for a biometric system. Adjustment to one extreme creates a system that requires perfect matches and result in a high rate of false rejects, but excessive false accepts. The trick is to find a nice balance between the two(near the point at the two error rates are equal).
Most of the technologies that scan human characteristics convert these images to some form of minutiae Each subsequent access attempt result in a measurement that is compared with an encoded value to verify the user's identity. A problem with this method is that the human body change due to illness, injuries, etc.
Fingerprints doesn't change but can be hard to read if a person has big wear on fingers.
Fingerprints:
Universitaly: Medium, Uniqueness: High, Permanence: High, Collectability:
Medium, Performance: High, Acceptability: Medium, Circumvention: High
Question:
are there any known or potential security concerns?
Yes. A system that uses biometrics as a security solution needs to have a good TCB(trusted computing base) to enforce security policy. This refers to the rules of configuration for a system. TCB is made up of the hardware and software that has ben implemented to provide security for a particular informations system. (Operating system kernel and specified set of security utilities, such as the user login subsystem.)
Weak hardware and software == weak login system that can be bypassed.
Are fingerprints easily recoverable from the cases of phones?
Not easy, but possible
Can an average hacker with full access to your phone try guessing "passwords" that represent your finger print?
Depends on the TCB(hardware and software). In a weak software, sure it's possible.
How unique and complex is a fingerprint compared to a password?
Fingerprints are considered truly unique.
Source:
Micheal E. Whitman(ph.D, CISM, CISSP), Principles of Information Security, 2015