I'm currently working on an offline authentication system for a multi-user mobile environment.
In order to avoid storing all passwords locally, which seems to be a bad idea, I proceed this way:
A first online authentication is required. the server then returns a token to the user, which will be used to perform future API calls.
In order to have several users on the same mobile/tablet, I need a way to store several tokens, and only let access to a particular user.
two solutions come to my mind:
- classic password, with the risk that the user enter the same password as their "main password"
- PIN code or similar code, without relation to the "main password" but less entropy
Fingerprint authentication would also be a solution, but not all device support fingerprint detection.
Both cases have drawbacks and both are weak, as they are vulnerable to offline attack
What would be the best way to authenticate a user in an offline, multi-user mobile environment?