Android Question (Solved)Unlock Pin

[iCAB]

Hi Guys

is there a way to request the user to enter the phone unlock pin.

Basically

   If fingerprint.HardwareDetected = False Then
    'Request Pin instead
   Else if fingerprint.HasEnrolledFingerprints = False Then
     ToastMessageShow("No fingerprints were enrolled.", False)
   Else
     btnAuthenticate.Enabled = True
End If

I am also looking for the equivalent code for B4I

Thanks

 

[JohnC]

https://www.b4x.com/android/forum/threads/fingerprint-authentication.72500/

 

[iCAB]

https://www.b4x.com/android/forum/threads/fingerprint-authentication.72500/

Thanks @JohnC , but the above link doesn't do the job (that's what I used for my initial post)

 

[JohnC]

At what point does it not work?

 

[iCAB]

If there is no fingerprint profile available, I would like to prompt the user to enter the actual pin#/password used to unlock the phone.
The above code doesn't do that.

 

[JohnC]

Ah, now I understand what you are trying to do.

 

[DonManfred]

If there is no fingerprint profile available, I would like to prompt the user to enter the actual pin#/password used to unlock the phone.

It is up to the deviceuser which unlock option is available/he want to use. If he choose not to use a pin then, i guess, you have no option to force him.
As far as i know there is no Api for that.

You can try to search for any java code on google or stackoverflow.

 

[agraham]

If an app asked me to enter the device unlock pin then my first action would be to immediately uninstall it and reset the phone to factory default in case it had loaded some malware.

 

[iCAB]

If an app asked me to enter the device unlock pin then my first action would be to immediately uninstall it and reset the phone to factory default in case it had loaded some malware.

Many banking apps require that. It is no different than requesting fingerprint. The app has no access to that the actual valued keyed by the user.

 

[iCAB]

It is up to the device user which unlock option is available/he want to use. If he choose not to use a pin then, i guess, you have no option to force him.

You are absolutely right, but it is no different than requesting the fingerprint. If there is no profile, then the code defaults to something else.

 

[JohnC]

I have to agree with agraham - if I imagine myself as a non-advanced user, I may not know that any app can display the system unlock screen (via an API call) and I would think that the app is trying to trick me into providing my PIN.

Maybe the solution could be adding the below options in your app, which would "teach" the user the difference:

---------------------
App Security (Make a Selection):

1) Use device's Fingerprint/Pin/Pattern lockscreen to access this app.
2) Use this app's own security screen to access this app.
---------------------

This will allow them to understand that your app can display the systems lock screen, and if they are uncomfortable with doing that, then your app can provide it's own security screen (if the user chooses #2).

 

[Brandsum]

App Security (Make a Selection):

1) Use device's Fingerprint/Pin/Pattern lockscreen to access this app.
2) Use built in security screen to access this app.
---------------------

This will allow them to understand that your app can display the systems lock screen, and if they are uncomfortable with doing that, then your app can provide it's own security screen (if the user chooses #2).

I think this is the correct way. @iCAB you can check google pay app. This is how it asks the user for the preferred authentication method.

 

[Erel]

Complete example:

Sub Activity_Click
   Dim ctxt As JavaObject
   ctxt.InitializeContext
   Dim KeyguardManager As JavaObject = ctxt.RunMethod("getSystemService", Array("keyguard"))
   Dim in As Intent = KeyguardManager.RunMethod("createConfirmDeviceCredentialIntent", Array("Title", "Description"))
   If in.IsInitialized = False Then
       Log("No password set!")
       Return
   End If
   StartActivityForResult(in)
End Sub

Sub StartActivityForResult(i As Intent)
   Dim jo As JavaObject = GetBA
   ion = jo.CreateEvent("anywheresoftware.b4a.IOnActivityResult", "ion", Null) 'ion is a process global object: Private ion As Object
   jo.RunMethod("startActivityForResult", Array As Object(ion, i))
End Sub

Sub GetBA As Object
   Dim jo As JavaObject
   Dim cls As String = Me
   cls = cls.SubString("class ".Length)
   jo.InitializeStatic(cls)
   Return jo.GetField("processBA")
End Sub

Sub ion_Event (MethodName As String, Args() As Object) As Object
   If Args(0) = -1 Then 'resultCode = RESULT_OK
       Log("User unlocked successfully!")
   End If
   Return Null
End Sub

Requires Android 5+.

 

[Erel]

If an app asked me to enter the device unlock pin then my first action would be to immediately uninstall it and reset the phone to factory default in case it had loaded some malware.

There is indeed a security weakness here. It shouldn't be too difficult to imitate the unlock screen.

 

[iCAB]

Erel's example code does exactly what we are looking for.

@JohnC, yes this is a great idea.

Thanks for all your valuable feedback. Greatly appreciated!