search

freeotp / freeotp-ios

Apache License 2.0
679 stars 171 forks source link

Apps Don't Require TouchID #242

Open tkiral opened 3 years ago

tkiral commented 3 years ago

I am using an iPhone SE 2020 on iOS 14.6. The following apps do not require TouchID: Dashlane, Microsoft and Discord. Coinbase, GitHub, Amazon and Tutanota all perform as expected and require TouchID.

justin-stephenson commented 3 years ago

Can you please elaborate on what the actual issue is? FreeOTP implements optional TouchID based on the user's decision when a token is added.

justin-stephenson commented 3 years ago

If the OTP Token URI presented from the server contains &locked=true, Biometrics authentication will also be enforced.

tkiral commented 3 years ago

Ah you’re right about Discord and Microsoft. I was thinking they were all locked but some aren’t it seems.

Even still, Dashlane does not require biometrics even though it has the “locked” symbol on the icon. I believe I chose to require biometrics for Dashlane.

On Aug 3, 2021, at 08:03, Justin Stephenson @.***> wrote:

 Can you please elaborate on what the actual issue is? FreeOTP implements optional TouchID based on the user's decision when a token is added.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.

justin-stephenson commented 3 years ago

Ah you’re right about Discord and Microsoft. I was thinking they were all locked but some aren’t it seems. Even still, Dashlane does not require biometrics even though it has the “locked” symbol on the icon. I believe I chose to require biometrics for Dashlane.

Does this happen specifically with 'Dashlane' tokens? Is there an OTP URI I can test out for this, or do I need to actually create an account?

tkiral commented 3 years ago

Sorry, I'm an uninformed user. I don't know how I'd know if there was an OTP URI. I'm only seeing this on Dashlane tokens.

On Tue, Aug 3, 2021 at 8:47 AM Justin Stephenson @.***> wrote:

Ah you’re right about Discord and Microsoft. I was thinking they were all locked but some aren’t it seems. Even still, Dashlane does not require biometrics even though it has the “locked” symbol on the icon. I believe I chose to require biometrics for Dashlane.

Does this happen specifically with 'Dashlane' tokens? Is there an OTP URI I can test out for this, or do I need to actually create an account?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/freeotp/freeotp-ios/issues/242#issuecomment-891957717, or unsubscribe https://github.com/notifications/unsubscribe-auth/AE2PJR7WP2U2HJMCSTKJ6CDT3AFSRANCNFSM5AE6SCJA .

justin-stephenson commented 2 years ago

Sorry I'm not clear exactly on the issue FreeOTP has handling these 'Dashlane' tokens, can you elaborate?

tkiral commented 2 years ago

Dashlane should require me to authenticate before displaying the OTP but it does not.

On Jan 31, 2022, at 20:27, Justin Stephenson @.***> wrote:



Sorry I'm not clear exactly on the issue FreeOTP has handling these 'Dashlane' tokens, can you elaborate?

— Reply to this email directly, view it on GitHubhttps://github.com/freeotp/freeotp-ios/issues/242#issuecomment-1026467741, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AE2PJRZWRYOWKHVEYBGPJLLUY5OJLANCNFSM5AE6SCJA. You are receiving this because you authored the thread.Message ID: @.***>

justin-stephenson commented 2 years ago

Does this happen after removing and re-adding the Token? If so then it sounds like Dashlane might be adding 'locked=false' to the OTP URI