3

I'm currently working on an offline authentication system for a multi-user mobile environment.

In order to avoid storing all passwords locally, which seems to be a bad idea, I proceed this way:

A first online authentication is required. the server then returns a token to the user, which will be used to perform future API calls.

In order to have several users on the same mobile/tablet, I need a way to store several tokens, and only let access to a particular user.

two solutions come to my mind:

  • classic password, with the risk that the user enter the same password as their "main password"
  • PIN code or similar code, without relation to the "main password" but less entropy

Fingerprint authentication would also be a solution, but not all device support fingerprint detection.

Both cases have drawbacks and both are weak, as they are vulnerable to offline attack

What would be the best way to authenticate a user in an offline, multi-user mobile environment?

Improve this question
2
  • 1
    Depending on what you're trying to do, you actually cannot authenticate a user offline, because you can't necessarily trust the client software.
    – Ben
    Apr 19, 2018 at 19:03
  • The token is also on the server-side, and will be compared when synchronizing the data. Sure, once a token is stored on the mobile device, one could use it to spoof a user, but a user need to login first. I'm aware that multi-user+mobile+offline make it impossible to have a 100% secure app, but I'm trying to do the best so an honest user/noobish hacker can't do anything
    – Kepotx
    Apr 20, 2018 at 7:41

1 Answer 1

Reset to default
1

Well, you can just invalidate the token and delete it whenever you want to switch users or otherwise "log out" the user, than use the online authentication with the online password check.

The only way to reliably protect a token from offline attack (as far as I can tell) is to encrypt it, which would require a password or pin. You should use a slow password derivation function with enough iterations, such as PBKDF2 to help with the entropy a bit.

Improve this answer
4
  • Ideally I want the possibility for user to switch even offline. Is storing several tokens encrypted with one password/pin for each a good idea?
    – Kepotx
    Apr 20, 2018 at 7:43
  • @Kepotx It is not necessarily a bad idea, though I have to wonder what your app is even doing. If it works with online API, then the offline switch is a bit of a moot point and if it works with offline data, you may want to encrypt all the user data to prevent the other user just bypassing the app and accessing its data files directly. You should also be very careful how you implement this, there are many caveats in this approach.
    – Peter Harmann
    Apr 20, 2018 at 8:10
  • It would be an app such as "user X performs action A, user Y performs action B", these actions will be stored and sent to the API when internet is recovered. They have access to interface to perform the actions, even offline, using local data. As some actions can only be done by some users, offline switch would be a great functionality
    – Kepotx
    Apr 20, 2018 at 8:18
  • @Kepotx Maybe, but there are considerations you have not made. If you want to use a token, than you would have to leave a plaintext copy with the api request, otherwise when internet is reconnected, you would not have access to the token. This means you can't really use a token at all, you need some kind of a signature. RSA or ECC may be useful here. Just encrypt the key with the user password, which is standard functionality in these libraries. You also won't need any login to the api, as you can just sign all requests or sign a special login request.
    – Peter Harmann
    Apr 20, 2018 at 8:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .