Flutter Local Authentication | Fingerprint and FaceID | Dart Packages 

Why thank you :)

south africa?

2 years ago I'm here to tell you had to change your android manifest and main activity files to allow the app to use the fingerprint scanning

@@Zegger Lol, I was using Flutter two years ago Wow it's been a while man

I quickly looked at the package (pub.dartlang.org/packages/flutter_secure_storage) and it seems that it only makes use of the keystore (Android) and keychain (iOS) to: "store cryptographic keys in a container to make it more difficult to extract from the device" - end quote. Don't think this package supports the capability to access the encrypted data with fingerprint/touchID. I'll try my best to explain (Also take what I'm saying with a grain of salt - security is constantly changing and some of this might be outdated, also I get mixed up with what Android does and what iOS does when it comes to encryption). On Android and iOS you can respectively make use of the keystore and keychain to store small portions of data and ensure only your application has the privilege to retrieve it - but "technically" if you root/jailbreak the device you can retrieve these objects, as you would have full privilege. Both Android and iOS further support the capability to only make the store/chain accessible once a user successfully passes fingerprint or touchID auth. Meaning that the data is only ever decrypted if the user passes biometric auth. Newer devices make use of something called a Secure Enclave (a separate chip, or mini computer), which is isolated from the rest of the device. As far as I have it, biometric auth and the relevant encryption/decryption magic happens in that isolated chip. Meaning that a compromised (or rooted) device cannot tamper with data protected by fingerprint/touchID - because a compromised device is still isolated from the Secure Enclave. On android you can protect data with auth by setting setUserAuthenticationRequired(true) when you generate an encryption key - see medium.com/overmorrow/authentication-sucks-bad-security-too-345ed20463d4 On iOS you can protect keychain items with kSecAccessControlTouchIDCurrentSet or kSecAccessControlTouchIDAny - see github.com/sensepost/objection/wiki/Understanding-the-TouchID-Bypass

@@FunwithFlutter Thank you for such an amazing response. Will try dig into it more 👍

@@frameshft5865 did you find anything useful?

Hey, I'll be doing something like that at a later stage. I'll be covering more technical videos as the channel matures, so stick around. I'm also waiting for a decent Flutter package to come along that will help with secure storage via biometrics.

I don't believe so. You need to make use of the built-in fingerprint API for Android and iOS. You as the developer have minimum control, for security reasons

Not from Dart code (maybe they'll add more features over time). This package is only invoking the relevant Android and iOS code, where the dialog is rendered. You can set a couple of extra text fields with the IOSAuthMessages and AndroidAuthMessages properties in the authenticateWithBiometrics call, see github.com/flutter/plugins/tree/master/packages/local_auth I have more experience with Android, so I can point you to the file where they customize the UI for the fingerprint dialog -> github.com/flutter/plugins/blob/master/packages/local_auth/android/src/main/res/layout/scan_fp.xml Not sure if iOS is more restrictive in the customization department. That all said there are certain style guides that developers are suggested to adhere to, and this fingerprint layout follows that. For Android P they've recently changed some things for Fingerprint Authentication, including the layout, so take a look. I suspect in the future this package will be updated to closer resemble that (for Android) -> medium.com/exploring-android/exploring-android-p-fingerprint-dialog-fa672ae62c6f

@@FunwithFlutter have you tried on Iphone simulator?

@@ngoclichtran4876 tried running this package on iPhone or tried to customize the UI dialog? To both of those, no :) There's a video that released today that goes through the same steps I did, while also testing on iPhone - ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-w0-UB7rx8TA.html He also touches on extra changes you need to add to the Android Gradle file - which might be why I had issues with the latest version of the package.

I would guess that it would default to the OS timeout. For Android that might be 30 seconds before you can try again. That or it would fall back to the device's passcode/password. Try it out and let us know

@@FunwithFlutter i had tried but not asking for passcode in IOS and in android it crashes the application

Sorry for the late reply. If you're still struggling I suggest you open a issue on GitHub/pub for the package. If you believe it to be an error on their side. Or paste your code on git and share the link, if I have time I'll take a look!

I'd recommend taking a look at the examples they give for the package.