Is there a special reason that errSecDecode is used and not errSecInteractionNotAllowed

[GasperC]

Hi there,

I checked the code and noticed that you are using "errSecDecode" to identify if device is locked, but while testing I always get "errSecInteractionNotAllowed" when device is locked.

Am I missing something?

[liamnichols]

errSecDecode indicates that the data couldn't be decoded. We use this to determine that the passcode is disabled because of the requirements that we enforced.

Looking at the OSStatus enum in SecBase.h:

CF_ENUM(OSStatus)
{
    errSecSuccess                               = 0,       /* No error. */
    errSecUnimplemented                         = -4,      /* Function or operation not implemented. */
    errSecIO                                    = -36,     /*I/O error (bummers)*/
    errSecOpWr                                  = -49,     /*file already open with with write permission*/
    errSecParam                                 = -50,     /* One or more parameters passed to a function where not valid. */
    errSecAllocate                              = -108,    /* Failed to allocate memory. */
    errSecUserCanceled                          = -128,    /* User canceled the operation. */
    errSecBadReq                                = -909,    /* Bad parameter or invalid state for operation. */
    errSecInternalComponent                     = -2070,
    errSecNotAvailable                          = -25291,  /* No keychain is available. You may need to restart your computer. */
    errSecDuplicateItem                         = -25299,  /* The specified item already exists in the keychain. */
    errSecItemNotFound                          = -25300,  /* The specified item could not be found in the keychain. */
    errSecInteractionNotAllowed                 = -25308,  /* User interaction is not allowed. */
    errSecDecode                                = -26275,  /* Unable to decode the provided data. */
    errSecAuthFailed                            = -25293,  /* The user name or passphrase you entered is not correct. */
};

errSecInteractionNotAllowed is something entirely different. I'm not sure why you are getting this error but its not because you don't have a passcode set.

How are you trying to check the passcode status in your code? Are you doing it while the application is active in the foreground?

[GasperC]

We are checking it in background (background fetch, significant location change).

Our goal is to determine if device is in locked/unlocked state while in background.

Looking even deeper we noticed that there is also "kSecAttrAccessibleWhenUnlocked" option so we will try to modify your code for our need. Does that seems like the right direction?

[liamnichols]

kSecAttrAccessibleWhenUnlocked probably wont work...

Its weird that you get errSecInteractionNotAllowed as i wouldn't have thought that user interaction was required but kSecAttrAccessibleWhenUnlocked isn't going to tell you if a passcode is set or not.

It'll just let you see if you are in the foreground or not but you might as well check the -[UIApplication state] property for that.

I doubt you're gonna be able to check the passcode state in the background at all.. Maybe rethink why you need to do this and if there are way to achieve what you want without relying on the user having a passcode set?

[GasperC]

We actually don't care about passcode. We want to figure out if user is using device (not our app) or if he has device in his pocket when background fetch or significant location change happens.

We are solving really a specific problem and need to figure this one out.

[liamnichols]

Ah ok then.. maybe give that other attribute a go then, but the docs do mention the foreground so there could be some sort of sandbox restriction with it.. See how it goes.. i'd be interested to hear the outcome :)

On 20 November 2015 at 14:16, Gasper Cvenkel [email protected] wrote:

We actually don't care about passcode. We want to figure out if user is using device (not our app) or if he has device in his pocket when background fetch or significant location change happens.

We are solving really a specific problem and need to figure this one out.

— Reply to this email directly or view it on GitHub https://github.com/liamnichols/UIDevice-PasscodeStatus/issues/6#issuecomment-158412652 .

[GasperC]

Sure, I will let you know.

Btw thanks for quick responses. :+1: