Skip to content
This repository was archived by the owner on Feb 22, 2023. It is now read-only.

Conversation

@chrisparton1991
Copy link

@chrisparton1991 chrisparton1991 commented Apr 14, 2021

Fixes flutter/flutter#81169.

Adds a new strongAuthenticatorsOnly flag that instructs Android to only allow secure biometric authentication mechanisms.

For instance, many Android devices use weak implementations of facial recognition, and in my experience most apps will only allow me to authenticate via fingerprint.

This change is backward compatible; omitting the flag will allow weak authentication as before.

Photo of strongAuthenticatorsOnly=false and strongAuthenticatorsOnly=true. This couldn't be a screenshot sorry, my phone won't allow me to screenshot the auth popup.
strongAuthenticatorsOnly

Note: I'm not sure how this will fit into the availableBiometrics method. At the moment I haven't made any changes there.
If the user has no secure methods available, a NoHardware or NotEnrolled should be returned.

List which issues are fixed by this PR. You must list at least one issue.
New feature.

If you had to change anything in the [flutter/tests] repo, include a link to the migration guide as per the [breaking change policy].
N/A

Pre-launch Checklist

  • I read the [Contributor Guide] and followed the process outlined there for submitting PRs.
  • I read the [Tree Hygiene] wiki page, which explains my responsibilities.
  • I read and followed the [Flutter Style Guide] and the [C++, Objective-C, Java style guides].
  • I signed the [CLA].
  • The title of the PR starts with the name of the plugin surrounded by square brackets, e.g. [shared_preferences]
  • I listed at least one issue that this PR fixes in the description above.
  • I updated pubspec.yaml with an appropriate new version according to the [pub versioning philosophy].
  • I updated CHANGELOG.md to add a description of the change.
  • I updated/added relevant documentation (doc comments with ///).
  • I added new tests to check the change I am making or feature I am adding, or Hixie said the PR is test exempt.
  • All existing and new tests are passing.

@chrisparton1991 chrisparton1991 force-pushed the local_auth/strong_authenticators_android branch from d32cac9 to b7ef013 Compare April 15, 2021 23:41
@stuartmorgan-g
Copy link
Contributor

Thanks for the submission! We’re currently working through a large backlog of PRs, and this will require non-trivial review, so it will take some time before we’re able to review it. As explained in CONTRIBUTING.md, votes for the corresponding issue are the primary way we’re prioritizing non-trivial reviews, so we encourage you to file an issue and associate it with this PR.

Note: I'm not sure how this will fit into the availableBiometrics method. At the moment I haven't made any changes there.

See discussion in #3763

@chrisparton1991
Copy link
Author

Hi @stuartmorgan, I've raised an associated issue, sorry I didn't see that earlier!

@stuartmorgan-g
Copy link
Contributor

Given that we're planning on making breaking changes to the plugin API to have it operate in terms of weak and strong on Android rather than specific biometrics, as discussed in the issue linked above, I'm going to close this; a separate boolean won't be necessary in that approach, and we don't want to add something to the API that we're planning on removing shortly. Thanks again for the contribution though!

@chrisparton1991
Copy link
Author

No problem, appreciate the update and the hard work!

@chrisparton1991 chrisparton1991 deleted the local_auth/strong_authenticators_android branch December 20, 2021 01:31
@charafau
Copy link
Contributor

@stuartmorgan Is there an issue for this somewhere? I'm also interested in this and would like to monitor the progress. Thanks!

@stuartmorgan-g
Copy link
Contributor

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[local_auth plugin]: Add option to only use strong biometric authentication systems on Android

4 participants