BlockchainCommons / GordianQRTool-iOS

UR & QR code storage for iOS and MacOS
Other
5 stars 7 forks source link

Leaks potentially secure information when returning from background. #44

Closed wolfmcnally closed 3 years ago

wolfmcnally commented 3 years ago

If QRVault is deactivated (the step before being fully backgrounded) it does not clear its screen first, resulting in possible leakage of secure information upon returning to the app. As you can see in these examples, the QR code that was last displayed is still fully visible on returning to the app, regardless of whether the user logs in using Sign In with Apple:

image

image

Wickr is an example of an app that clears its screen when being deactivated.