Currently in the middle of a rather long-winded process of deciding upon the use of TouchID within an application being developed due, to security concerns, and wondered if anyone had any advice?

The idea from a product point of view is that a user can register with the application with a username/password (bog-standard flow in case of fall back for devices with no touch id) and then at a later date, if turned on via in-app preferences, use the TouchID system to 'login' to the application instead of typing a username/password again.

My concern is that this somehow means we have to store something on the device (retrievable upon successful touch) which can then authenticate the user and allow them access to the API (via JWT token, but probably doesn't matter).

This goes against almost everything I have ever read and been involved in with regards to mobile application development, which is storing anything sensitive on the client device is opening yourself up to an attack vector.

Yet - many applications already do this, so I am wondering what a typical process for enabling such a feature would be?

The app is sensitive by nature, has some personal information management which would be bad if leaked, if this makes a difference to the approach!

Thank you in advance


Suppose you have an iOS app that accepts a username and passcode. This login information would be entered by the user, then you could store that state by saving the credentials in the Keychain, which is the only place secure enough to store that information on device.

If the above is already in place, than adding Touch ID only increases security because the iOS Touch ID API works by simply unlocking keychain items. So you would use the LocalAuthentication framework to ask for Touch ID authentication. This API would then present the UI on the screen, send the encrypted fingerprint data to the Secure Enclave, and send you back a result that simply specifies whether the match was successful or not, optionally unlocking the associated keychain item for the user's login item. At no time is your app given access to the fingerprint data, and if you need further authentication you can associate a keychain item that would be unlocked on success.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.