PhilippC / keepass2android

Password manager app for Android
https://play.google.com/store/apps/details?id=keepass2android.keepass2android
GNU General Public License v3.0
4.81k stars 389 forks source link

BiometricPrompt API showstopper for in-display fingerprint scanner #1156

Closed uselessregistrationatgithub closed 4 years ago

uselessregistrationatgithub commented 4 years ago

As indicated by title.

The change in biometry API breaks biometric authentication with in-display scanner on Galaxy Tab S6.

App shows "biometric hardware detected, do you wish...?" and upon being told "yes" wants me to authenticate, but fails to actually enable the sensor. There is noting short of "cancel" that I could do. Authentication via face scan (which is configured on the device and works reliably otherwise) does not seem to be attempted, either.

Identical setup on Galaxy S9+ phone (sensor on backside) works 100% trouble-free.

keepass2android version 1.08-r1 (updated last night, worked fine before).

System is as up-to-date as Samsung will let me have it: Samsung Galaxy Tab S6 (SM-T865) DE-de Android 9 One-UI 1.5, kernel 4.14.83-17437689 (6. Dezember 2019) Knox 3.4 / API lv 29 Security Patch vers. 1. Dezember. 2019

PhilippC commented 4 years ago

unfortunately face unlock on older Samsung phones is not considered to be safe biometric prompt. I think you need to set fingerprint as default biometric method, if I remember correctly.

uselessregistrationatgithub commented 4 years ago

Hi Philipp, thanks for the help.

That is indeed a functional workaround (though it breaks face unlock upon flipping the cover open, which is a very nice feature). Fingerprint scanner activates as it should, everything works flawlessly. Maybe a good idea to add a hint in the release notes, or even better on the "activate biometry" action page to prevent people from wondering? Such as "If this does not work for no obvious reason, you may need to..."? There's plenty of screenspace available on that page, should be easy.

BTW: The Galaxy Tab S6 is the most recent tablet they sell, so I'm surprised it wouldn't work on that one (whereas on the S9+ which is arguably somewhat older (though not "old"), everything works fine).

albrtms commented 4 years ago

Dear Philipp, why is it not possible to use the default Android biometric API, which is using both fingerprint readers and face ID, depending on what the device has? If you consider Face ID insecure, you may as well write down a warning on the settings dialogue. But if a user chooses to use this authentication method, it's basically his choice. Plus, the new Pixel face unlock and should be able to differentiate between an actual face and a photo.

PhilippC commented 4 years ago

1.08 is using standard biometric prompt from Android and the decision to consider *Samsung's FaceID" insecure is made by Google, not me.