search

authpass / biometric_storage

Flutter plugin to store data behind biometric authentication (ie. fingerprint)
https://pub.dev/packages/biometric_storage
MIT License
184 stars 107 forks source link

[iOS] Plugin returns `success` when no biometric is set up #40

Open lucaspal opened 3 years ago

lucaspal commented 3 years ago

I am using the canAuthenticate method from this plugin to check whether any biometric security mechanism is enabled and setup. Despite the device only having a pin code setup, I still get a success back.

HOW TO REPRODUCE

I am then calling BiometricStorage::canAuthenticate. I would expect to get back CanAuthenticateResponse.errorNoBiometricEnrolled but I am, instead, getting back CanAuthenticateResponse.success.

As far as I know, PIN code should not be considered a biometric security mechanism, hence the current behaviour could represent a bug.

DETAILS Device: iPhone 12 mini OS: iOS 14.8

luckyrat commented 2 years ago

After #70 is resolved, I'll be thinking about #10 because I have a desire to display an accurate icon to the user given the biometrics that are actually available to them on their device.

I think this issue is closely related and could potentially be resolved by the creation of a new API that can either report back what methods are supported and/or limit the ones that the app permits to be used.

Arguably, "canAuthenticate" does not directly imply anything about how one can authenticate the user (although the name of the package might). So I'm not sure this is necessarily a bug, but I'll bear it in mind when working on ideas to resolve #10 and we can at least try to expand the documentation about this and the hypothetical new API.

hpoul commented 2 years ago

Well, it kind of works as intended .. the canAuthenticate is basically only meant as a way to check if it is possible to use the StorageInitOptions.authenticationRequired .. But I agree that it might be good idea to additionally have a more granular check what kind of authentication is supported..