Use of FaceID and TouchID

[cpg]

use touch id to remember user credentials and login with the fingerprint reader.

i will try and design a proper flow -- maybe the most basic is to add a toggle in settings to use touch id and ask the user to verify at that moment with it, the use it afterwards if enabled, until it's disabled.

the login page may need a little fingerprint "icon" somewhere -- or maybe just try touch id if enabled unless the user cancels.

[iswiftshek]

The toggle thing in settings sounds the best option.

Also, for the UI (login screen), how about we just keep it simple like this?

On successful event, we can directly sign in the user otherwise we can give them the option to try again or enter the password manually as shown above.

[cpg]

Sounds good. I think we should default to using touch ID, since the app is always logged in anyway, it's not a burden. We did not get requests to automatically log out users, but maybe one day we get them.

[codedentwickler]

So I don't think it would work as described above though, the user needs to login with their Username and Password.

Currently, I don't think the Amahi server supports login with fingerprint so it can't really replace the default username/password login now.

[iswiftshek]

@codedentwickler Yes, right. So what I was thinking was, like, let's say the user gets logged out. Then maybe we can store the credentials and have them log back in using Touch ID instead of having them put in the userid/pass

But yes, the user will probably not be logged out and so this Touch ID feature doesn't really sound too relevant for now.

[codedentwickler]

Okay, we could do that. But then we have to worry about hashing password since it is not advisable to store the raw password strings.

[cpg]

By now we kind of have to extend to FaceID

[cpg]

I think this may be the best flow:

• once the user logs in (whatever form of login -- regular auth or PIN based login) successfully
• the user is asked if they want biometrics, if not, then that's the same flow as now (credentials are saved as it's done now, so login is automatic still)
• if yes, then, 1) the method of login and 2) the credentials are saved for future use when login is required again (i.e. after a logout)
• if biometrics is successfully used, this is also kept in the settings
• if biometrics fails, login flow is as it is done now
• in the settings there is a toggle, where it can be revoked
• if it's not in use and the tooggle is set long after login, then the user is autheticated and the credentials and method used (do we know it at this time?) is kept