github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-12 05:04:17 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

TouchID on iOS - Fallback to device passphrase #306

New Issue
Closed
opened 2025-11-07 08:34:49 -06:00 by GiteaMirror · 4 comments
GiteaMirror commented 2025-11-07 08:34:49 -06:00
Owner
Copy Link

Originally created by @Ardtas on GitHub (Nov 21, 2018).

On iOS Devices (App Version 1.19.4 (41)) you can bypass TouchID and use the normally much weaker device passphrase, if you enable unlock by TouchID.

To reproduce the problem:

  • Enable TouchID in the Bitwarden iOS App
  • Lock your database or let the auto-lock time pass
  • Open your database
  • Unlock via a not stored finger
  • Press logout
  • Now you can unlock your Bitwarden database via your device code

I think this is an unwanted way to unlock your database, since most people's device codes are only 4-8 digits and definitly weakens the security. I tried this on android (Nexus 5X, Android 8.1.0 (via LineageOS) , App Version 1.19.0 (1585)) too, logout instead leads to a logout in the Bitwarden app.
Sadly I have no FaceID device available, maybe someone else could try this out on one of the FaceID devices.

Originally created by @Ardtas on GitHub (Nov 21, 2018). On iOS Devices (App Version 1.19.4 (41)) you can bypass TouchID and use the normally much weaker device passphrase, if you enable unlock by TouchID. To reproduce the problem: - Enable TouchID in the Bitwarden iOS App - Lock your database or let the auto-lock time pass - Open your database - Unlock via a not stored finger - Press logout - Now you can unlock your Bitwarden database via your device code I think this is an unwanted way to unlock your database, since most people's device codes are only 4-8 digits and definitly weakens the security. I tried this on android (Nexus 5X, Android 8.1.0 (via LineageOS) , App Version 1.19.0 (1585)) too, logout instead leads to a logout in the Bitwarden app. Sadly I have no FaceID device available, maybe someone else could try this out on one of the FaceID devices.
GiteaMirror commented 2025-11-07 08:34:50 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Nov 21, 2018):

This seems like a pretty standard way of falling back from TouchID.

If someone knows the users passcode, they can easily just disable TouchID on the device anyways, along with decrypting the keychain and whatever else they want to do. The passcode is the thing that protects the device in the end.

@kspearrin commented on GitHub (Nov 21, 2018): This seems like a pretty standard way of falling back from TouchID. If someone knows the users passcode, they can easily just disable TouchID on the device anyways, along with decrypting the keychain and whatever else they want to do. The passcode is the thing that protects the device in the end.
GiteaMirror commented 2025-11-07 08:34:50 -06:00
Author
Owner
Copy Link

@Ardtas commented on GitHub (Nov 22, 2018):

Thank you for the answer. In the mean time, I have verified, that the same behaviour applies for the iCloud Keychain. I think the behaviour with android would be better in a security-wise way, but I think this is something that cannot be changed by a single application.

@Ardtas commented on GitHub (Nov 22, 2018): Thank you for the answer. In the mean time, I have verified, that the same behaviour applies for the iCloud Keychain. I think the behaviour with android would be better in a security-wise way, but I think this is something that cannot be changed by a single application.
GiteaMirror commented 2025-11-07 08:34:50 -06:00
Author
Owner
Copy Link

@luckydonald commented on GitHub (Jun 16, 2019):

The 1password behaviour is to fall back to the actual vault password, which is much more secure than a 4 digit password which is the same as the device password.
The device password might already be known to the attacker as the phone is unlocked.

@luckydonald commented on GitHub (Jun 16, 2019): The 1password behaviour is to fall back to the actual vault password, which is much more secure than a 4 digit password which is the same as the device password. The device password might already be known to the attacker as the phone is unlocked.
GiteaMirror commented 2025-11-07 08:34:50 -06:00
Author
Owner
Copy Link

@Crocmagnon commented on GitHub (Jun 17, 2019):

Well just set your device passcode to something more secure than 4 digits...
iOS defaults to 6 digits now I believe and you can always use a real passphrase with a full keyboard.
If you have TouchID or FaceID you will rarely have to type it anyway.

Again, as @kspearrin said, if you know the device passcode you can enroll your fingerprint/face and then access the vault so resorting to vault passphrase when biometrics don't work is not a real solution either.

@Crocmagnon commented on GitHub (Jun 17, 2019): Well just set your device passcode to something more secure than 4 digits... iOS defaults to 6 digits now I believe and you can always use a real passphrase with a full keyboard. If you have TouchID or FaceID you will rarely have to type it anyway. Again, as @kspearrin said, if you know the device passcode you can enroll your fingerprint/face and then access the vault so resorting to vault passphrase when biometrics don't work is not a real solution either.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#306
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?