Open darekdeo opened 2 years ago
Hi,
I also came to a similar conclusion after looking through the code.
Specifically, the following getPhrase-function looks like BRKeyStore
has been downgraded to a legacy-migration: https://github.com/breadwallet/breadwallet-android/blob/4c0149e9bc7a2c5fe4eb0ac5e0f6eccd91660c63/app/src/main/java/com/breadwallet/tools/security/BrdUserManager.kt#L319 https://github.com/breadwallet/breadwallet-android/commit/4c0149e9bc7a2c5fe4eb0ac5e0f6eccd91660c63
In other words, it seems to me that BRKeyStore
is only present for migration-purposes and all new app-users are using some kind of encrypted shared preferences.
The function migrateKeystoreData
indicates this migration: https://github.com/breadwallet/breadwallet-android/blob/a6b8add794ced98b2ea77c3dcecaadd7a91dfdd7/app/src/main/java/com/breadwallet/tools/security/BrdUserManager.kt#L179
Hi, I've found 2 issues regarding biometric/fingerprint security used in app. First of all, sorry if I misunderstood something from reading the code, I took only fast glimpse at it without downloading/checking out project.
This first problem is mostly problematic for biometric/fingerprint because I can only enable biometric for logging into app and leave it disabled for transactions. Imagine now someone else has registered his biometric fingerprint on my device too, he doesn't know my BRD app PIN but if he could enter the app, he can easly just enable biometric for transactions and voila. Separate switch for biometric login and transactions doesn't serve any purpose for user security. This goes into the 2nd issue...
The 2nd problem is related to first 1. Because if someone malicious can gain access to user's device (for example weak device PIN), he can probably easly add new fingerprints too. If in BRD biometric/fingerprint is enabled it will not react to adding new fingerprints and will allow malicious user to access the app, change the settings for transactions and steal wallet resources. Even if user will set strong PIN for BRD, he is not safe if he has weak device PIN and enabled biometric/fingerprint in BRD.
This issue doesn't mean to attack the app, it's great open source project. Thank you all for working on this. I'm only pointing few issues I've found while testing the app and taking the glimpse at the code, hope it will be helpful.