biometric_storage icon indicating copy to clipboard operation
biometric_storage copied to clipboard

[iOS] Plugin returns `success` when no biometric is set up

Open lucaspal opened this issue 3 years ago • 2 comments

I am using the canAuthenticate method from this plugin to check whether any biometric security mechanism is enabled and setup. Despite the device only having a pin code setup, I still get a success back.

HOW TO REPRODUCE

  • Enable PIN code
  • Make sure that no biometric mechanism is enabled (e.g. FaceID)

I am then calling BiometricStorage::canAuthenticate. I would expect to get back CanAuthenticateResponse.errorNoBiometricEnrolled but I am, instead, getting back CanAuthenticateResponse.success.

As far as I know, PIN code should not be considered a biometric security mechanism, hence the current behaviour could represent a bug.

DETAILS Device: iPhone 12 mini OS: iOS 14.8

lucaspal avatar Oct 04 '21 14:10 lucaspal

After #70 is resolved, I'll be thinking about #10 because I have a desire to display an accurate icon to the user given the biometrics that are actually available to them on their device.

I think this issue is closely related and could potentially be resolved by the creation of a new API that can either report back what methods are supported and/or limit the ones that the app permits to be used.

Arguably, "canAuthenticate" does not directly imply anything about how one can authenticate the user (although the name of the package might). So I'm not sure this is necessarily a bug, but I'll bear it in mind when working on ideas to resolve #10 and we can at least try to expand the documentation about this and the hypothetical new API.

luckyrat avatar Jul 04 '22 17:07 luckyrat

Well, it kind of works as intended .. the canAuthenticate is basically only meant as a way to check if it is possible to use the StorageInitOptions.authenticationRequired .. But I agree that it might be good idea to additionally have a more granular check what kind of authentication is supported..

hpoul avatar Jul 04 '22 19:07 hpoul