Return to Answer

added 55 characters in body

Source Link

edited Aug 27, 2018 at 17:15

59.3k
21
162
214

So you have a setup where the user needs to do full username / password authentication, but as a short-cut you allow them to use a PIN until the session expires.

I would follow the model used by the Keepass2Android client:

When you open the app (equivalent to your new session), you need to do the full authentication process.

While the app remains open, but in the background, you can re-open it using a short-cut -- last 3 characters of your password, fingerprint scanner, etc (equivalent to your PIN, I think).

When you fully close the app, you will need to do the full login next time.

So following that model, I would have them enter one PIN at install, when opening a new session they must re-enter their full credentials, and while the session is open they may use the PIN.

I don't see any difference here between whether the session expired naturally or because they clicked Log Out. I also don't see any reason to ever force them to choose a new PIN; that seems like it's asking for usability problems ("What's my PIN, if that's what you're implying again??") for minor-at-best security benefits.

So you have a setup where the user needs to do full username / password authentication, but as a short-cut you allow them to use a PIN until the session expires.

I would follow the model used by the Keepass2Android client:

When you open the app (equivalent to your new session), you need to do the full authentication process.

While the app remains open, but in the background, you can re-open it using a short-cut -- last 3 characters of your password, fingerprint scanner, etc (equivalent to your PIN, I think).

When you fully close the app, you will need to do the full login next time.

So following that model, I would have them enter one PIN at install, when opening a new session they must re-enter their full credentials, and while the session is open they may use the PIN.

I don't see any difference here between whether the session expired naturally or because they clicked Log Out. I also don't see any reason to ever force them to choose a new PIN, if that's what you're implying.

So you have a setup where the user needs to do full username / password authentication, but as a short-cut you allow them to use a PIN until the session expires.

I would follow the model used by the Keepass2Android client:

When you open the app (equivalent to your new session), you need to do the full authentication process.

While the app remains open, but in the background, you can re-open it using a short-cut -- last 3 characters of your password, fingerprint scanner, etc (equivalent to your PIN, I think).

When you fully close the app, you will need to do the full login next time.

So following that model, I would have them enter one PIN at install, when opening a new session they must re-enter their full credentials, and while the session is open they may use the PIN.

Source Link

created Aug 27, 2018 at 17:09

Mike Ounsworth

59.3k
21
162
214

So you have a setup where the user needs to do full username / password authentication, but as a short-cut you allow them to use a PIN until the session expires.

I would follow the model used by the Keepass2Android client:

When you open the app (equivalent to your new session), you need to do the full authentication process.

While the app remains open, but in the background, you can re-open it using a short-cut -- last 3 characters of your password, fingerprint scanner, etc (equivalent to your PIN, I think).

When you fully close the app, you will need to do the full login next time.

So following that model, I would have them enter one PIN at install, when opening a new session they must re-enter their full credentials, and while the session is open they may use the PIN.