Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Document LAContext reuse behavior #476

Closed
hvge opened this issue Sep 12, 2022 · 0 comments
Closed

Document LAContext reuse behavior #476

hvge opened this issue Sep 12, 2022 · 0 comments
Assignees
Milestone

Comments

@hvge
Copy link
Member

hvge commented Sep 12, 2022

Once we allowed use LAContext object instead of prompt string for the biometric authentications, we opened a gate that allows application to use such context for multiple times. Basically, application can pre-authorize its own context and re-use it for multiple times for the biometric signature.

We should mention in documentation that this usage is strongly not recommended, due to the following reasons:

  • LAContext can be reused for a very long time and the biometric dialog is not displayed. The exact time depends on iOS implementation, but can be longer than 5 minutes and shorted than 10 minutes (validated by our experiments)
  • It would cause a legislative problems in case that application signs a critical data (like payment). It would be problematic to prove that user authenticated such request, or it's just a bug in the application.
@hvge hvge added this to the 1.8.0 milestone Sep 12, 2022
@hvge hvge self-assigned this Sep 12, 2022
@hvge hvge closed this as completed in 00431c2 Sep 20, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant