authenticate-me's Introduction

Authenticate me. If you can...

This repository contains the source code for my article (habr, medium) about PIN & Biometrics authentication methods in Android apps.

Structure

For your comfort the repository is divided by several branches according to the article structure:

Each branch contains the final solution for the corresponding step.

Architecture

This project is not about the right architecture™, but rather about authentication and security principles behind this process. Feel free to adapt these approaches to your needs.

authenticate-me's People

Contributors

Stargazers

Watchers

authenticate-me's Issues

javax.crypto.IllegalBlockSizeException when logging in

Found this repository through the article and thought it was great. While giving it a try I found a crash that might be worth noticing.

Steps to reproduce:

Use biometrics to authenticate
On the AuthorizedFragment hit back
Land in the "login" page again and the prompt opens up
Use Biometrics again to authenticate
See the Stack Trace below

Tested in both Android API 28 and 29

The reason is that we are using the same crypto object to authenticate twice because when you go back and re-subscribe to the biometricParams live data its sending the previous params

Process: com.redmadrobot.authenticateme, PID: 18327
    java.lang.Error: javax.crypto.IllegalBlockSizeException
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1173)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        at java.lang.Thread.run(Thread.java:919)
     Caused by: javax.crypto.IllegalBlockSizeException
        at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:519)
        at javax.crypto.Cipher.doFinal(Cipher.java:2055)
        at com.redmadrobot.authenticateme.unauthorized_zone.login.pin.input.InputPinViewModel$authenticationCallback$1.onAuthenticationSucceeded(InputPinViewModel.kt:53)
        at androidx.biometric.BiometricFragment$2$2.run(BiometricFragment.java:138)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) 
        at java.lang.Thread.run(Thread.java:919) 
     Caused by: android.security.KeyStoreException: Key user not authenticated
        at android.security.KeyStore.getKeyStoreException(KeyStore.java:1292)
        at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.update(KeyStoreCryptoOperationChunkedStreamer.java:132)
        at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:217)
        at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:506)

[Question] - Do we need cipher?

Hello,

First of all, awesome article and even awesome repo. Just a quick question:
Since nowadays we have EncryptedSharedPreferences do we really need to use Pbkdf2Factory and all that logic of coding and decoding to safely store the pin? In your sample you end up using EncryptedSharedPreferencesbut you use another security layer on top of it. Is it just another security layer or it has other purposes?

Thanks.

Recommend Projects

fi5t / authenticate-me Goto Github PK

authenticate-me's Introduction

Authenticate me. If you can...

Structure

Architecture

authenticate-me's People

Contributors

Stargazers

Watchers

Forkers

authenticate-me's Issues

javax.crypto.IllegalBlockSizeException when logging in

[Question] - Do we need cipher?

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent