8000 Biometric authentication uses evaluatePolicy method · Issue #1 · diia-open-source/ios-authorization · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Biometric authentication uses evaluatePolicy method #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Tachibanaff opened this issue Mar 14, 2024 · 0 comments
Open

Biometric authentication uses evaluatePolicy method #1

Tachibanaff open 7BC4 ed this issue Mar 14, 2024 · 0 comments

Comments

@Tachibanaff
Copy link

The application uses biometric authentication as an alternative way (apart from pincode) to authenticate user and grant access to the main functionality.

ios-authorization/Sources/PinCode/Common/Services/BiometryHelper.swift

Line 55 in 2c4f03d

localAuthenticationContext.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, localizedReason: reason) { success, evaluateError in

As described in OWASP MASTG:

The evaluatePolicy function returns a boolean value indicating whether the user has authenticated successfully.

evaluatePolicy method is bypassable with the usage of RE tools, such as objection

OWASP MASVS 4.8, MSTG-AUTH-8

Biometric authentication, if any, is not event-bound (i.e. using an API that simply returns "true" or "false"). Instead, it is based on unlocking the keychain/keystore.

Suggestion
As described in OWASP MASTG (again):

The iOS keychain APIs can (and should) be used to implement local authentication. During this process, the app stores either a secret authentication token or another piece of secret data identifying the user in the keychain. In order to authenticate to a remote service, the user must unlock the keychain using their passphrase or fingerprint to obtain the secret data.

The keychain allows saving items with the special SecAccessControl attribute, which will allow access to the item from the keychain only after the user has passed Touch ID authentication (or passcode, if such a fallback is allowed by attribute parameters).

See more details:

  1. https://mas.owasp.org/MASTG/iOS/0x06f-Testing-Local-Authentication/#using-keychain-services-for-local-authentication
  2. https://developer.apple.com/documentation/localauthentication/accessing_keychain_items_with_face_id_or_touch_id
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@Tachibanaff
0