search

CodingZeal / redux-persist-sensitive-storage

redux-persist storage engine for react-native-sensitive-info
MIT License
248 stars 34 forks source link

Clarification on authentication #28

Open JeremyBradshaw7 opened 4 years ago

JeremyBradshaw7 commented 4 years ago

The docs for react-native-sensitive-info, on which this package relies, suggests that the user has to provide authentication info before it allows access to the keychain or shared preferences (eg. fingerprint, touch ID, face recognition). I've deployed this to various devices through testfairy and never get prompted to further authenticate, so am puzzled as to when and why this extra layer of security would kick in. Some clarification would be useful, we'd have to advise our users what to expect if we rolled this out to the stores.

I'm slightly scared where the docs say "Every time the app wants to access the protected keychain item, a prompt by iOS will show up." - we wouldn't want to annoy our users by them having to respond to repeated prompts.

erksch commented 4 years ago

I think you can just look into the docs of react-native-sensitive-info. You can use properties to control whether modals for touch id or similar stuff should be displayed. I guess the default is false. But I have not tried any of that.

JeremyBradshaw7 commented 4 years ago

As far as I can gather the extra layer of security in react-native-sensitive-info is optional, defaulting to off, but I can't see in the docs for this package where you set it on or leave it off.