Bypass maximum biometric unlock times limit #1800

New Issue

2025-11-26T22:58:28-06:00

GiteaMirror commented

2025-11-26 22:58:28 -06:00

Originally created by @CanglanXYA on GitHub (Feb 2, 2024).

Steps To Reproduce

Go to the bitwarden unlock screen and do 5 failed attempts
App will notify "You are locked" and forces you to type password
Now lock the phone screen and unlock, the biometric window (a a13 system level service) just merges again !
So you can have unlimited attempts before finally open the vault

Expected Result

Stop asking for biometric unlock after unlock screen again

Actual Result

Always pop up a window for unlock by using biometric methods

Screenshots or Videos

No response

Additional Context

No response

Operating System

Android

Operating System Version

Android 13 AOSP-like system

Device

No response

Build Version

2024.1.1(8843)

Beta

Using a pre-release version of the application.

Originally created by @CanglanXYA on GitHub (Feb 2, 2024). ### Steps To Reproduce 1. Go to the bitwarden unlock screen and do 5 failed attempts 2. App will notify "You are locked" and forces you to type password 3. Now lock the phone screen and unlock, the biometric window (a a13 system level service) just merges again ! 4. So you can have unlimited attempts before finally open the vault ### Expected Result Stop asking for biometric unlock after unlock screen again ### Actual Result Always pop up a window for unlock by using biometric methods ### Screenshots or Videos _No response_ ### Additional Context _No response_ ### Operating System Android ### Operating System Version Android 13 AOSP-like system ### Device _No response_ ### Build Version 2024.1.1(8843) ### Beta - [ ] Using a pre-release version of the application.

GiteaMirror added the bug label 2025-11-26 22:58:28 -06:00

GiteaMirror closed this issue

2025-11-26 22:58:28 -06:00

GiteaMirror commented

2025-11-26 22:58:28 -06:00

@Greenderella commented on GitHub (Feb 8, 2024):

Hi there,

Thank you for your concern regarding the PIN attempts resetting. At the moment, this is the expected behavior for the PIN functionality, and I really think it shouldn't be considered a security concern. Let me clarify why:

Biometric Security: The primary security for your device and app is biometric (like fingerprint or facial recognition), which requires your physical presence. This ensures that only you, the device's owner, can gain access.
PIN Attempts Reset: The PIN acts as a secondary access method. Its attempts reset after you unlock your device with biometrics, because successfully using biometrics confirms you're the rightful owner. This process assumes that once biometrically authenticated, any action (including resetting PIN attempts) is authorized.

This design safeguards your account by preventing unauthorized access in case your phone is lost or stolen. With biometric security in place, unauthorized users cannot bypass it, and the PIN attempt limit thwarts any attempts to guess your PIN, ensuring your account remains accessible to you, while securely protecting it from unauthorized entry.

If you feel like this should be different please check the Bitwarden Community Forums, it has a Feature Requests section for submitting, voting for, and discussing requests like this one: https://community.bitwarden.com/c/feature-requests/

Please sign up on our forums and search to see if this request already exists (https://community.bitwarden.com/signup). If so, you can vote for it and contribute to any discussions about it. If not, you can re-create the request there so that it can be properly tracked.

This issue will now be closed. Note that the “Closed as not planned” status is for internal tracking purposes only, please do not hesitate to send us your suggestions to the forum.

Thanks!

@Greenderella commented on GitHub (Feb 8, 2024): Hi there, Thank you for your concern regarding the PIN attempts resetting. At the moment, this is the expected behavior for the PIN functionality, and I really think it shouldn't be considered a security concern. Let me clarify why: - Biometric Security: The primary security for your device and app is biometric (like fingerprint or facial recognition), which requires your physical presence. This ensures that only you, the device's owner, can gain access. - PIN Attempts Reset: The PIN acts as a secondary access method. Its attempts reset after you unlock your device with biometrics, because successfully using biometrics confirms you're the rightful owner. This process assumes that once biometrically authenticated, any action (including resetting PIN attempts) is authorized. This design safeguards your account by preventing unauthorized access in case your phone is lost or stolen. With biometric security in place, unauthorized users cannot bypass it, and the PIN attempt limit thwarts any attempts to guess your PIN, ensuring your account remains accessible to you, while securely protecting it from unauthorized entry. If you feel like this should be different please check the Bitwarden Community Forums, it has a Feature Requests section for submitting, voting for, and discussing requests like this one: https://community.bitwarden.com/c/feature-requests/ Please sign up on our forums and search to see if this request already exists (https://community.bitwarden.com/signup). If so, you can vote for it and contribute to any discussions about it. If not, you can re-create the request there so that it can be properly tracked. This issue will now be closed. Note that the “Closed as not planned” status is for internal tracking purposes only, please do not hesitate to send us your suggestions to the forum. Thanks!