search

theQRL / mobile-wallet

QRL mobile wallet based on the react-native framework
MIT License
11 stars 22 forks source link

App Pin can be bypassed #73

Closed 12remember closed 5 years ago

12remember commented 5 years ago

There are three different possibilities to access the app while Settings > "Lock app with Pin" = on.

Action: Possibility 1: When pinscreen promps > press return button of mobile(right button) > app opens and the Balance is shown.

Possibility 2: When app is open > press return button of mobile(right button) to homescreen of phone > doing other stuff on phone (navigate to other apps or lock the phone) > Press QRL wallet app > it opens without asking for a pin.

Possibility 3: When app is open > press home button of mobile(left Button) > close the qrl app by swiping it > doing other stuff on phone (navigate to other apps or lock the phone) > Press QRL wallet app > it opens without asking for a pin.

Expected Result: Locking the app with the pin after pressing return or home button en returning to the app.

Actual Result: app can be accessed without entering pin.

Android Version: 7.0 Android Handset model: Samsung Galaxy S6 SM-G920F

thetestspecimen commented 5 years ago

I also have this problem. However, there are quite a lot of circumstances where the pin lock doesn't work.

In my case the only time it prompts for a pin is when the app has been put into the background, but not closed, and then brought back to the foreground.

The above suggests to me this is an android lifecycle issue.

Android Version: 9 Phone: OnePlus 5

ademcan commented 5 years ago

Thanks, this issue has been solved in v2.0.7. As @thetestspecimen mentioned it seemed like a lifecycle issue on Android. The solutions proposed are as follow: Possibility1: the back button on the PIN screen (and main screen) is disabled Possibility2: See above (related to P1) Possibility3: The "killing" of the app is now taken into account when relaunching the app and will ask the PIN if the option is turned on