1

My client has an android application requirement. The users of the application are workers who might have to work at places where internet connectivity is unavailable. So an offline login feature is necessary. At the moment, it is implemented by setting a pin code during the first sign in by a user into the app for a device. Next time when offline login is attempted, the pin is checked locally and guid is used to cross verify the device check and offline access is granted.

The user can use the app as normal, update any field he wants and the data is stored locally. When internet connectivity is restored the app will send them to the server. No other check is implemented here.

Is this secure enough from a security perspective? What things can be done here to improve the security of this feature?

0

1 Answer 1

1

Instead of using custom user sign in, you can use android system API that can perform in-app authentication backed by Trusted Execution Environment (TEE). It supports both biometric and device credential authentication.

Your app's sensitive data should be cryptographically bound to the in-app authentication to ensure that even if the attacker compromises the OS, the app data cannot be decrypted. To achieve this, you can use android keystore system to generate a new secret key which is kept inside TEE. This key is a primary (master) key that encrypts one or more keys that encrypt & decrypt app's sensitive data and auth token and are kept outside of TEE. TEE will not unlock the primary key until in-app user authentication is successful. See Require user authentication for key use.

Also, before providing data access, you must decrypt and verify auth token first provided by your web service to validate if the token is not expired and if the user is allowed offline access.


You can use Android Jetpack Library for implementation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.