search

smstuebe / xamarin-fingerprint

Xamarin and MvvMCross plugin for authenticate a user via fingerprint sensor
Microsoft Public License
491 stars 116 forks source link

Fingerprint grace period? Doesn't require user to enter #10

Closed teimaj closed 8 years ago

teimaj commented 8 years ago

Hi, i have been using your fingerprint plugin, and it has been great so far, however one thing i noticed is that it doesn't ask me for my fingerprint on an device, but it does on a simulator. Let me explain the issue:

On my application i give the user the ability to turn on fingerprint login in the settings, this works fine, the dialog appears and they enable fingerprint login. I then go to logout of the application, so that the user is prompted to login again, and the fingerprint login dialog should appear, on the simulator it does appear, and on the device it does not appear. The device treats it as authenticated... Almost like there is some time period after initially entering a fingerprint, for which a user will no longer have to enter it. If i completely close the app and then open it again, the dialog appears, so potentially it is still in memory.

I've tried to search for any documentation on this, but i'm unable to find it, mainly because i don't know specifically what i'm searching for. I'm sorry if im wasting your time

Thanks

smstuebe commented 8 years ago

I have noticed this behavior, too. I think iOS is caching the authentication for a while. I haven't found anything on the specification, yet. I'll try to throw the LAContext away everytime. If it solves the problem, I will fix it.

jgfaulk commented 8 years ago

I am experiencing this behavior as well. I found this article that may help. Specifically in the "Touch ID Enhancements" section, it mentions a new property in iOS 9 on the LAContext called touchIDAuthenticationAllowableReuseDuration.

smstuebe commented 8 years ago

Hey touchIDAuthenticationAllowableReuseDuration does nothing for me :crying_cat_face: I tried throwing the context away and it worked. So I introduced CrossFingerprint.AllowReuse for iOS. set it to false in your AppDelegate and the dialog should appear every time you try to authenticate.

Its available on nuget as beta package https://www.nuget.org/packages/Plugin.Fingerprint/1.1.1-beta

It would be nice, if you can test it and give some feedback. A iOS 8 real device test would be really cool, too :cat:

teimaj commented 8 years ago

Awesome, ill aim to test it in the morning , however unfortunately i don't have a iOS 8 device with me, but ill test that when i get to work on Monday morning 😁

Thanks for the quick fix 👍

smstuebe commented 8 years ago

@teimaj did you test it?

teimaj commented 8 years ago

Sorry, i missed work most of last week due to illness, and when i got in i forgot to check. I'll make sure i do it at some point tomorrow morning.

I did realise that i don't have an iOS 8 device with Touch ID, i thought it was a iPhone 5S that i had, but it was an iPhone 5, so I'm not sure if i'll be able to put iOS 8 on a newer device.

kspearrin commented 8 years ago

I am testing this on an iPhone 6S, iOS 9. The AllowReuse = false flag in the beta release solved it for me. Thanks.

teimaj commented 8 years ago

Just tested and the flag worked, however i'm unable to test on iOS 8 as i still don't have a device with it on, sorry

smstuebe commented 8 years ago

Ok, the only question now is, if I should use this as default setting. I didn't experience a automatic invalidation, yet.

teimaj commented 8 years ago

I would set this as a default setting, as it appears that most applications that use Touch ID always ask for your fingerprint regardless of time in-between each validation.

smstuebe commented 8 years ago