Biometrics on Android

[kathaypacific]

Description

The initial experiment for biometrics was limited to only iOS users because the iOS keychain mechanism is more predictable and robust. This allowed us to develop and validate the feature faster.

The experiment yielded favourable results so we should enable it for all users. https://www.notion.so/valora-inc/Done-Biometric-option-9f3c0347b7c54a449b14ccd190b8314a

AC

• [ ] Enable biometric verification on Android in the same way as iOS
• [ ] Should be implemented as a follow up experiment. Experiment design is here: https://www.notion.so/valora-inc/All-Experiments-c82002f042504ca8a37f420fcf6affc2?p=de27a61bb2864f9ab4f6845a5ece2f0b

Eng

• [x] The existing remote config flag can be reused
• [x] The last time biometrics for android was attempted, there were several edge cases for which it didn't work well. Need to talk to Jean to get specifics, but good to see if those can be accounted for - have discussed but could not remember the details.
• [x] Sometimes biometrics would become disabled/unenrolled for the device, we should have a solution for this scenario (tested: when biometrics is un-enrolled, the app will just ask for pincode. when biometrics is re-enrolled, biometrics automatically works in the app without turning it on again. i think this is the correct behaviour, since un-enrolling from biometrics does not necessarily mean you want to revoke all the secrets you stored with biometrics for the future)
• [x] Verify that the solution works as expected when the user updates their biometrics/adds new faces and fingerprints/switches off biometrics from their device settings
• [x] Check if there needs to be extra params for react-native-keychain

Iris icon is here https://www.figma.com/file/j84MQn5xaOJ9RBjuIZgxPN/Onboarding-Experiments?node-id=1156%3A12577#179770055

Android 12 - look for bugs here Let's enable for the nightly build and test internally for a few weeks before releasing, to cover testing with more devices and uncover weird scenarios

[kathaypacific]

@nityarao we still need the iris image

[kathaypacific]

Update: it seems like biometrics on Android will (mostly) only work with fingerprint and not face. There are certain requirements that must be met for biometrics to be considered secure enough to access secret items in the Android key store and most android devices have weak face biometry. https://github.com/oblador/react-native-keychain/issues/301#issuecomment-1121971609

This means for most users,:

• face + fingerprint enabled = Valora requires fingerprint
• fingerprint enabled only = Valora requires fingerprint
• face enabled only = Valora will not use biometrics

There are some devices like Pixel 4 which only has strong face biometry and no other biometry sensors. We need to test to see how this looks...