search

Crypho / cordova-plugin-secure-storage

Secure storage plugin for Apache Cordova
MIT License
278 stars 269 forks source link

Android secureDevice #55

Closed briananderson1222 closed 8 years ago

briananderson1222 commented 8 years ago

@ggozad I am trying to figure out when, or I guess how this functionality disappeared. On our application running on Android with an insecure device we used to get prompted to secure our device (I assume this happened in the unlockCredentials method in SecureStorage.java). In the init method I notice there is an else if statement that would potentially run this code if the initial if statement didn't return false (line 77 of SecureStorage.java). I also, now notice for the android version I can potentially just force a call to this secureDevice method that appears like it'll call the unlockCredentials call. Am I missing something or did this method used to fire in the past and get updated somewhere along the way? What is the recommended way of invoking this message?

briananderson1222 commented 8 years ago

@ggozad if secureDevice is intended to be used for invoking this modal why does it exist as a prototype method rather than a static one? Wouldn't I want to attempt to 'secure the device' before initializing my secure storage?

.. Also why are these callbacks required? and in the case of the secureDevice method what do they mean? I could swear that this modal used to pop up on its own before but using an insecure device is not our normal use case so I hadn't tested this in a month or so.

ggozad commented 8 years ago

Hey! This has indeed changed a couple versions ago. Here's the rationale (which is also somehow described in the README, but feel free to improve the wording in a PR). When initializing SecureStorage if the device is not secure the failure callback is going to be called. This gives the opportunity to the app to explain what is going on instead of prompting directly to change the screen lock without any explanation. Before the screen lock setting were invoked immediately without any explanation which was confusing to users. Several people requested this to change so that they can explain why the users should change their lock settings or perhaps opt-out of using secure-storage altogether.

Let me know if this explains.