up vote 2 down vote favorite

I have an Android mobile app which currently asks the user for a username and password to login. For security reasons, the session token expires in 2 hours so it has to ask for the username and password often which can be frustrating and annoying for mobile for users. I'd like to replace the username and password screen with a PIN code screen to make it easier for the user to login often. What are some best practices and standards for PIN code implementation without compromising the security of the application?

At first login, the app will ask the user to input a preferred PIN code after they have logged in successfully.

share|improve this question
  • 1
    "without compromising the security" - what do you mean by that phrase? What risks do you want to counter? – schroeder♦ Sep 6 '17 at 10:26
  • @schroeder by that I mean that replacing a username/password prompt to a PIN code it might lead to it being less secure. I'd like the solution to bridge this security gap as much as possible. – Savv Sep 6 '17 at 10:48
  • 2
    I think this: "For security reasons, the session token expires in 2 hours" is the part you should evaluate again. Why is this necessary? The way I see it: Once your user is authenticated this only protects against an attacker gaining access to the app if he/she gained acces to the device before. – Tom K. Sep 6 '17 at 11:36
  • 1
    @Tom that is a good point. I may need to rethink about session expiration rules. Thanks – Savv Sep 6 '17 at 15:20
up vote 1 down vote

What you want would require the token to be valid indefinitely. However, that WOULD compromise the app security. Therefore, you have to find a way to get 2 tokens onto the device, one valid for 2 hours, the second one indefinitely. However, anyone who gains access to the mobile device can access the token as well, leading to an account compromisation. To prevent that, you could encrypt the token. A token encrypted by 4 digits might still not be strong for your use case, but that is outside my knowledge.

share|improve this answer

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.