Biometrics are widely used for user identification/authentication, but the fact has rarely been noticed that general capacitive touchscreens can reveal user identities by touch signals. This paper proposes a new biometric method with inherent liveness detection for reliable user recognition based on the cardiac signal captured by the capacitive touchscreen, namely Capacitive Plethysmogram (CPG). And a systematic framework is designed for CPG collection, processing, and exploitation to identify users. Specifically, since the finger usually forms capacitors with multiple sensing electrodes during touching, we can extract several CPG signals simultaneously from the screen output. Then we propose a series of preprocessing algorithms to filter CPG for signal quality enhancement. Finally, to further leverage filtered CPG signals and extract efficient features for identifying users, we build an encoder based on 3D attention CNN and metric learning. Experimental results demonstrate that the proposed method can achieve an average accuracy of 96.73%, FAR of 3.03%, and FRR of 7.35% in the laboratory environment, which reveals the potential of CPG for user privacy protection and data security on various devices laced with capacitive touchscreens.