Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Operation success after failed biometry in offline #256

Open
kober32 opened this issue Oct 31, 2019 · 1 comment
Open

Operation success after failed biometry in offline #256

kober32 opened this issue Oct 31, 2019 · 1 comment

Comments

@kober32
Copy link
Member

kober32 commented Oct 31, 2019

When requesting authentication with biometry (for example PowerAuth.authenticateUsingBiometry call on Android), the request will call success callback (with dummy data) when the biometry fails after several failed attempts on both iOS and Android (when the system will just dismiss the dialog with something like "too many failed attempts").

This behavior is OK when you're calling the server with the result, which will reject the request and thus will raise the fail counter.

But it's not OK for offline authentication when there is no server verification and the user is just presented with the wrong output in the end.

This could be solved with adding a flag to the call, telling the SDK that the returned data won't be verified by the server, or the callback object (IBiometricAuthenticationCallback in Android) could be extended with a new method - something like onBiometryDialogTooManyAttempts, or onBiometricDialogFailed could be used with some specific exception.

@hvge
Copy link
Member

hvge commented Nov 5, 2019

This needs to be considered properly. I understand that the requested behavior is good for the user's experience, but not for the security.

Changing from bug to enhancement.

@hvge hvge added enhancement and removed bug labels Nov 5, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants