System wide lockout after 5 consecutive unrecognized fingerprints?

Hello,

First, some observations:


If your finger is dirty/greasy/wet and you try to use touch ID to extract an item from the keychain in any app, after 5 consecutive failures, an interesting system wide lockout of touch ID service takes place which can only be reset by entering your device passcode.


To reset the Touch ID service, the device passcode can be entered either on the lockscreen (iOS at that point will not let you use TouchID to unlock device, you must enter device passcode) or by going to the Touch ID & Passcode section in Settings.


I've tested this with 4 separate Touch ID enabled apps and the Touch ID lockout is system wide, until reset by entering device passcode.


The code returned back to the app in this case is errSecAuthFailed. Another way that this code can be returned to the app is if instead of resting your finger on the home button, you press it instead, causing a return to the home screen. Doing this any number of consecutive times does NOT cause a Touch ID system lockout. In this case it's considered a user action error and not considered a potential device access breach.


I understand what's happening here, this is a security feature in iOS in case an un-authorized user attempts to use their fingerprint to gain access to your apps data. Doing this on a Touch ID enabled app has the same result as using the 'wrong' finger on the device lockscreen: 5 consecutive failures and the device passcode must be entered.


Second, my 2 questions:


  1. Is this documented anywhere?
  2. Other than 5 consecutive fingerprint identification failures are there any other security cases which cause a system wide Touch ID service lockout?


My second question is important because for our app we've had reports of the Touch ID system wide lockout happening and were curious if this is the only way users can get themselves in trouble.


Thanks,

--Neal

Answered by neal1 in 195461022

Found LAErrorTouchIDLockout described in a header file as being triggered by several consecutive touch id failures, so I will assume for now that is the only way that it can be triggered. The logic in my app when it gets an errSecAuthFailed error is to check if LAContext canEvaluatePolicy: yields a LAErrorTouchIDLockout, and if so inform the user to enter their device passcode on the lockscreen to reset the lock.

I should provide one more important detail: Initially, when the iOS dialog that prompts you to scan your fingerprint is up and and an invalid finger print is scanned, the SecErrAuthFailed error is not reported to the app until after 3 consecutive failures. The text in it shakes to let you know something's wrong.


Causing that iOS dialog to come up again and then scanning an invalid finger print 2 more times will cause you to get the last 'normal' SecErrAuthFailed reported back to the app. After this, the app (all apps actually) will immediately always report SecErrAuthFailed on any attempt to bring up the Touch ID system dialog. That is until the device passcode is entered somewhere as specified in my origianl post.

Accepted Answer

Found LAErrorTouchIDLockout described in a header file as being triggered by several consecutive touch id failures, so I will assume for now that is the only way that it can be triggered. The logic in my app when it gets an errSecAuthFailed error is to check if LAContext canEvaluatePolicy: yields a LAErrorTouchIDLockout, and if so inform the user to enter their device passcode on the lockscreen to reset the lock.

System wide lockout after 5 consecutive unrecognized fingerprints?
 
 
Q