I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User will be prompted to re-enter their password upon viewing these screens that present this data. One our requirements from Product team is asking for a usability feature that I think is a potential vulnerability.
They are basically asking for when the user leaves the field that they are typing their password to verify that it immediately turns to red or green, if the password locally is verified as invalid or valid. This seems it would make it too easy for an attacker to pick up someone's iPhone and repeatedly guess the password stored locally on the device. I would think we should check and validate with the server.
I'm asking for someone who may know more about the best practices to answer this question.