search

twofas / 2fas-android

Source code for 2FAS Android app
GNU General Public License v3.0
791 stars 62 forks source link

Ability to enable fingerprint unlock without setting pin #114

Open Vaibhav-Lodha opened 4 months ago

Vaibhav-Lodha commented 4 months ago

I know pins can a failsafe, but we should have the ability to just set fingerprint unlock instead of first setting the pin all together

partha51613 commented 4 months ago

I don't think this is a good idea since sometimes fingerprint does not register. In such cases, a PIN is necessary.

Andrew15-5 commented 3 months ago

If you have a backup file saved and finger registered, and it works, then there is no issue in allowing to use pin-free fingerprint option. Because the most awful thing would be to reinstall the app, reconnect to the browser extension and import the saved backup. But even that would probably take like 5 minutes or so.

I like this idea, because pin isn't very safe anyway. If someone saw it once, then they can bypass the fingerprint scanner. Just saying.

KobeW50 commented 3 months ago

If you have a backup file saved and finger registered, and it works, then there is no issue in allowing to use pin-free fingerprint option. Because the most awful thing would be to reinstall the app, reconnect to the browser extension and import the saved backup. But even that would probably take like 5 minutes or so.

There isn't a way the application can know that you have a backup saved, and even if it does know, this is bad design. The solution for the possibility of biometrics no longer working is to have a pin/password as a failsafe. This is standard practice in almost every application that allows biometric verification.

I like this idea, because pin isn't very safe anyway. If someone saw it once, then they can bypass the fingerprint scanner. Just saying.

The solution to this is to be able to set a longer password, and to protect your screen from prying eyes.

Andrew15-5 commented 3 months ago

There isn't a way the application can know that you have a backup saved, and even if it does know, this is bad design.

I haven't said that the application has to know it and that it would be a great design. All the responsibility in creating a backup, preferably before making a fingerprint-only access, goes to the user. Sure, the common user isn't the ideal user, but AFAIK some apps do have such option and I like it. Because the chance of my finger being chopped off or burned beyond recognition is fairly low to put it lightly.

The solution to this is to be able to set a longer password, and to protect your screen from prying eyes.

Yeah, I agree that if I can put in a long password instead of a 4-digit number, then it will be better. And yet it still wouldn't be as safe as enabling a fingerprint-only option.