If a fingerprint authentication mechanism, such as iOS's Touch Id, informs an app that it has been successful, how does one securely call back to a web server such that a security ticket can be authorised? Surely, something verifiable must be submitted along with the request otherwise anyone could call the service directly.


Secure enclave doesn't really do any call back to web servers since Touch ID's a replacement for local passcode, and not directly tied with any third-party service. I think in order to enable using touch ID inside an app like Paypal, you need to have already logged into Paypal using your ID and password. Then enabling touch ID basically ties this token with touch ID. So it goes touch ID -> secure enclave -> yes Paypal, a positive match -> Paypal goes and now uses stored token or cookie (or whatever the mechanism is) made from the initial login using the password to do Paypal stuff on its own.

|improve this answer|||||
  • 1
    Very nice answer. But what if the token has an expiry date? Ideally, the shorter the lifespan of a token, the better. Does that mean, services like Paypal are using permanent tokens? – alex351 Jun 4 '19 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.