PIN Protection on the app

Still needs a fallback considering how volatile Touch ID registrations are, how the app facing API works and that a graceful degradation is required on unsupported devices or when the sensor is unavailable/non-functioning due to temperature, gloves, replacement (though iOS breaks pretty badly if you do that), MDM policy, etc.


Here’s how Revolut does it. It’s PIN by default but if you’re on a supported device, it’ll automatically invoke the system Touch ID Keychain item unlock once (per launch) to jump straight through it. Additionally providing a way to reinvoke it (lower right button) if future iOS behaviour changes or if the user accidentally cancels out as well as a method of recovering from being locked out (bottom left).

Zendesk Inbox is Touch ID only on the app authentication and doesn’t provide a way of reinvoking it. This means that this security is only for Touch ID users and if you cancel out for any reason, the app gets in a broken state and needs to be force quit to recover (and no, just retrying on failure doesn’t work well). Not a good implementation at all.

It’s nice saying “Touch ID or it’s useless” and Touch ID is great but it’s limited by design to be a faster, shortcut method of authentication, not the only method of authentication. Though I do recognise that PIN entry is yet another shortcut for entering in your full Mondo password.