Here you go.  htc stored unencrypted fingerprint images as a world-readable file on phones.<p><pre><code>   On the HTC One Max X the fingerprint is saved as &#x2F;data&#x2F;dbgraw.bmp with a 
   0666 permission setting (world readable). Any unprivileged processes or apps 
   can steal user’s fingerprints by reading this file.
</code></pre>
Particularly given Google&#x27;s (charitably), well, lax supervision of what apps that make it into the play store do, this is amazing.<p>Also, even when you&#x27;re not dealing with incompetent morons at htc, the same article points out that on other Samsung and HTC devices, any app can directly query the fingerprint sensor.<p>Samsung and HTC appear to be strictly amateur hour.  After stuff like this, how can you trust what an Android phone is doing with your fingerprint?<p><a href="http:&#x2F;&#x2F;www.theguardian.com&#x2F;technology&#x2F;2015&#x2F;aug&#x2F;10&#x2F;htc-fingerprints-world-readable-unencrypted-folder" rel="nofollow">http:&#x2F;&#x2F;www.theguardian.com&#x2F;technology&#x2F;2015&#x2F;aug&#x2F;10&#x2F;htc-finger...</a>