4 ms·
Yeah this is pretty glaring. Changing the biometrics should automatically invalidate all FaceID tokens and block falling back to device PIN. It should effectiv
by cassianoleal 3y ago
Yeah this is pretty glaring.
Changing the biometrics should automatically invalidate all FaceID tokens and block falling back to device PIN. It should effectively log the device out of all services, perhaps even delete browser cookies etc. since it should mean the person holding the phone is not the one who logged on to those.
Of course, this could have other implications so a lot of care has to be taken when designing and implementing this.
- Tommstein 3y agoAndroid appears to do something like this with fingerprints (or at least enable it). Whenever I add a new one, apps stop accepting fingerprints until I enter my password/passcode/whatever in each one.
- cassianoleal 3y agoThat's ok but in this case it won't help since the attacker already has the phone's passcode.
- Tommstein 3y agoIf each app has its own password/passcode that you can bypass with your fingerprint, and fingerprints suddenly stop working, it absolutely does shut down the thief, unless you also use the phone's passcode for all your accounts.
- cassianoleal 3y agoOh I see. On the iPhone though, FaceID / TouchID are the same as the passcode - at least in the sense that if the biometrics fail, they fall back to the passcode. This means that if you enable log in with biometrics, you’re essentially enabling the fallback along even if the app has a separate PIN/passcode.
- Shadowmist 3y agoI just tried it on my iPhone with a banking app and it shows me the default login screen for the bank and then logs me in if my face is there, but without the face it just stays on the login screen waiting for me to enter the bank password, never asks for a PIN.
- cassianoleal 3y agoHuh, I just tried this with a couple of my bank apps and they do the same. I guess either I'm misremembering this, or it got fixes along the way. Wallet is still accessible with the device passcode as a fallback though, which means quite a lot of damage can still be done.
- pests 3y agoThe fallback is the service account password, not the local device PIN.
- snotrockets 3y agoIt does get invalidated if the app use the right api call: https://developer.apple.com/documentation/localauthentication/laauthenticationrequirement/3975713-biometrycurrentset https://developer.apple.com/documentation/localauthenticatio...
- easton 3y agoMicrosoft’s apps use this (although, sometimes it gets triggered even if I didn’t change my biometrics).
- yunohn 3y agoAll banking and finance apps I use have this correctly setup.
- cassianoleal 3y agoTherein lies the problem, I guess. How is it left to the application developer to implement this properly? As a user of the device, I expect biometrics (a feature of my platform of choice) to behave consistently.
- snotrockets 3y agoNot all threats scenarios are the same. The problem is that there's very little in the way of forcing the app developers to accept liability if they misjudge the threat scenario (a notable exception are banking apps in the US)