Fingerprint support

[snaggen]

It would be nice to be able to decrypt the wallet using fingerprint. There are plugins available for Cordova, and from a shallow look it seems that the Android plugin have the functionality needed. https://github.com/mjwheatley/cordova-plugin-android-fingerprint-auth

[paulshapiro]

Hi @snaggen, thanks for the request, and plugin research . This makes sense as a feature. I'd probably have a few minor details left to confirm while actually implementing this, but the plugin does look like it would work.

Just some points for whoever adds this…

• When the app is "locked out", i.e. requires a user password, the app does not know what the password is. It verifies the password is correct by being able to successfully decrypt a saved challenge blob (https://github.com/mymonero/mymonero-app-js/blob/master/local_modules/Passwords/Controllers/PasswordController.js#L448). It then uses that valid password to decrypt the user data for wallets, contacts, etc. So we'll need to use the plugin to store the password itself. I'm thinking the best way to do this is not to put the fingerprint scanner in PasswordController, but in the password entry UI itself. That way the plugin can go through all existing code and we will be able to give the user visual feedback that their fingerprint-unlocked password is being automatically input into the password field.

• Every time the user sets or changes their password, we'll have to inform the plugin so that it re-encrypts. Probably should do that first before accepting the changed/new password, in order to handle errors in the fingerprint saving first.

• When user deletes everything/clears data, fingerprint data needs to be cleared. Not exactly sure where the best place to put this is yet. Wouldn't want to confuse PasswordController with Cordova-and fingerprint-specific code unless it can be abstracted or placed into a new Cordova-specific PasswordController concrete implementation. May not be necessary. Maybe a good idea to place that kind of routing in index.cordova.js, or just pull the trigger on creating a new object… something like FingerprintAuthController.

[paulshapiro]

I'm thinking about closing this issue since we've moved on from Cordova in this repo to building the Android app totally separately, since fingerprint support isn't hugely applicable to desktop (yet, anyway... I actually think we could find a way to add it for MacOS at least) .. but we actually use it on iOS for app action authorization /after/ app unlock, intentionally (at least for now) opting not to store the password information in the keychain, secured by the fingerprint, just to be on the safe side.