Face ID and Touch ID done securely

Security Mid-level Swift 5.0+ iOS 17+ Reviewed By Alok Singh

Pick the fix

You want Face ID to protect access to a stored refresh token. Most secure approach?

Options
Hint 1 of 1

Where should the check be enforced?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Store the token in the Keychain with SecAccessControl .biometryCurrentSet, and read it to trigger Face ID

Correct. The Secure Enclave releases the token only after a successful match.

Why not the others?
  • B Call evaluatePolicy and read the token from UserDefaults on success. The token isn't protected, and the boolean can be bypassed.
  • C Save didPassFaceID = true in the Keychain. A stored flag isn't a cryptographic check.
  • D Ask for Face ID every time the app launches, then load the token normally. The token is still readable without biometrics.

30-second answer

For a simple gate, LocalAuthentication's LAContext.evaluatePolicy returns success or failure, but that boolean can be tampered with on a compromised device. To protect a secret, store it in the Keychain with an access control such as .biometryCurrentSet, so the Secure Enclave releases it only after a successful biometric check. Add NSFaceIDUsageDescription and offer a passcode fallback.

Practise saying it · 45 s. No recording, just a timer

Explain secure biometric auth.

Say your answer out loud, then check which of these points you covered:

  • LAContext for gates
  • Keychain access control for secrets
  • Fallbacks and errors

Deep dive

.biometryCurrentSet invalidates the item when biometrics are re-enrolled.

.deviceOwnerAuthentication allows passcode fallback.

Check canEvaluatePolicy and handle lockout and not-enrolled errors.

Never store the biometric result as a flag.

Common mistakes

  • Treating evaluatePolicy's boolean as protection for data.
  • Missing NSFaceIDUsageDescription, which crashes on Face ID devices.

Senior take & follow-ups

Seniors bind secrets to biometrics through the Keychain, not a boolean.

Follow-up questions

Think of your answer first, then open the hint.

  1. What does biometryCurrentSet protect against?

    Show hint

    Someone adding their own face or finger later.

  2. Is Face ID data available to the app?

    Show hint

    No; the app only gets a result.

Related questions

Suggest a fix if something here is wrong or out of date.