Mobile application biometric authentication is prone to bypasses

[Balanced02]

Expected behavior

Should implement biometrics authentication at the keychain level and not application level

Actual behavior

The authorization is implemented at application level, instead of keychain level. Therefore, it is prone to bypasses – users may access plaintext passwords without biometric authentication in some cases.

Recommendations

Use the react-native-keychain’s BIOMETRY_CURRENT_SET flag to allow access to passwords only with already enrolled fingerprints.

Which version(s) does this affect? (Environment, OS, etc...)

• iOS and android