Skip to content
This repository has been archived by the owner on Apr 15, 2020. It is now read-only.

Number of passcode attempts is not persisted, allowing easier brute-force attacks #178

Open
mgod opened this issue Jun 4, 2018 · 0 comments

Comments

@mgod
Copy link
Contributor

mgod commented Jun 4, 2018

At the moment, in the AppLockActivity, mAttempts does not get saved if the activity is killed. This means if you're trying to limit the number of passcode attempts in onPinFailure to some small number n, an attacker can bypass this by trying n-1 pin codes, then killing the app and trying n-1 more passcodes.

This should be pretty easy to work around by managing my own count of pin attempts that is persisted, but it seems like this should be built into the library. I'm happy to open a PR for this if it makes sense.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant