infinum / flutter-plugins-locker

Flutter plugin that secures your secrets in keychain using biometric authentication (Fingerprint, Touch ID, Face ID...).
https://pub.dev/packages/flutter_locker
MIT License
29 stars 9 forks source link

Can't save data on Android #36

Closed tudor07 closed 8 months ago

tudor07 commented 1 year ago

I have a Samsung S8 with PIN and face recognition enabled.

This code fails with PlatformException

await FlutterLocker.save(
  SaveSecretRequest(
    key: 'password',
    secret: _password,
    androidPrompt: AndroidPrompt(
      title: 'Authenticate',
      cancelLabel: 'Cancel',
    ),
  ),
);

Stacktrace:

I/flutter (27388):    PlatformException(LockerException, -1, Cause: null, Stacktrace: -1
I/flutter (27388):  at com.example.flutter_locker.FlutterLockerPlugin$save$1.onError(FlutterLockerPlugin.kt:42)
I/flutter (27388):  at co.infinum.goldfinger.GoldfingerImpl$1.onCryptoObjectCreated(GoldfingerImpl.java:136)

Cause:

co.infinum.goldfinger.CryptoObjectInitException: CryptoObject failed to create.
java.lang.IllegalStateException: At least one fingerprint/iris/intelligentScan must be enrolled to create keys requiring user authentication for every use

I tried removing face recognition and adding fingerprint and it worked. However I think it should work with face recognition as well.

On iOS everything works fine.

itsJoKr commented 1 year ago

The underlying Android library only uses strong authentication. Face recognition on that phone is probably just a plain camera and can not be considered strong, it can be easily proved false-positive with a photo of person.

For strong face authentication, you need to have few more sensors (like NIR sensor) that iPhone has. Only Android that has that afaik is Pixel 4.