Page MenuHomePhabricator

[Cashtab] Deprecate biometric authentication
ClosedPublic

Authored by bytesofman on Dec 15 2022, 18:49.

Details

Reviewers
emack
Group Reviewers
Restricted Project
Commits
rABC45ad3cc89c48: [Cashtab] Deprecate biometric authentication
Summary

T2881

Deprecate biometric authentication. The feature does not persist through Cashtab state change (i.e. a hard refresh). The feature would be technically complex to support through local storage, which is also not 100% reliable in a web app as it depends on the browser.

These gaps make the feature more a security threat vector than a security feature. It is only able to lock the app using the same lock a user has set on their phone. This redundant lock (that sometimes disables itself) should be deprecated.

Test Plan

npm start
App works fine
Settings page does not display lock setting
npm run build
netlify deploy
Test on mobile with app that was previously set to auth on -- should load with auth off, no issues
Test on mobile with app that was previously set to auth off -- should load with auth off, no issues

Diff Detail

Repository
rABC Bitcoin ABC
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

emack requested changes to this revision.Dec 16 2022, 12:31
emack added a subscriber: emack.

Tested all ok on iOS and Android however I did a comparison with the genesis biometric diff D10443 and found some other elements for removal in the interest of reducing unnecessary resources that were only used for biometric purposes (I have grep'ed these to verify):

  • assets/fingerprint-solid.svg
  • theme.buttons.primary.disabledOverlay
  • theme.buttons.secondary.disabledOverlay
  • utils/convertArrBuffBase64.js
This revision now requires changes to proceed.Dec 16 2022, 12:31

Will keep this tabled for now.

IMO the feature is mostly security theater. However, some users do seem to like it, and there are niche applications.

responding to feedback + rebase

This revision is now accepted and ready to land.Dec 27 2022, 01:38