Mobile app: when biometric fails have a fallback other than system unlock.
Enabling "Use system lock when biometric fails" is insecure in the following scenario: someone shoulder-surfs in a crowd to find out your phone's PIN or unlock pattern, then steals your phone. They will then have access to your Proton Pass contents. It would be better to allow app-specific PIN code and Biometric unlocking to be active at the same time, rather than forcing users to choose between them. Users can then disable "Use system lock.." and still have a secure fallback if biometric lets them down.
Alternatively, a master password could be used as a fallback.
2
votes
PakMan
shared this idea
-
Jeremy
commented
YES. Ever since Apple introduced Stolen Device Protection, meaning Keychain can only be accessed with Touch ID, this made me realize how much Proton Pass needs this.