-
Notifications
You must be signed in to change notification settings - Fork 119
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Added CryptoObject to Android #229
base: master
Are you sure you want to change the base?
Conversation
After way more testing and reading into it, i further improved it a little bit. If i find time, i will implement this but in another branch and do a new pull request. |
@smstuebe Can you merge this for the .NET Maui prereleases? |
If you have time could you also look in #231 ? |
Out of scope for this PR I guess, but are there any kind of tests that are run? Should we look into adding some? I'm curious to know the rationale. |
The only tests i could run where some Frida scripts. I tried to adjust few to test more cases but thats it. I'm not into frida too much to say how hard it would be to make automated tests, since i already had to build a specific environment to test it. But for other parts i would be happy if someone wants to write tests! :) Never bad to have some |
Is there something blocking this PR from entering main? I'm using this NuGet and the mentioned security vulnerability is a concern I'd rather see fixed. Also, any plans on fixing this same vulnerability on iOS's side? |
Not sure if there is a similar vulnerability in iOS since the CryptoObject is an android specific component. But even if there is a same vulnerability, it would need someone with an iOS Dev environment because i don't have any apple devices. If you dont want to wait for the pr, download and recompile it yourself. Did the same until the pr is merged. |
Let's get this merged! |
Great! Thanks. Please merge this! |
We are using this as part of the net8 MAUI project and decided to update this project and release the new version as Open-Source: https://github.com/oscoreio/Maui.Biometric I will be glad if you can transfer this PR to a new project. I can guarantee a quick review and acceptance of changes. |
Mentioned in #225 there is a security vulnerability in the current android implementation.
I fixed it with examples from Microsoft and Googles Android documentation.
The current state is tested against the Frida Script (as of writing)
https://codeshare.frida.re/@Saket-taneja/biometricauthenticationbypassnullcryptoobject/
It is not required to make use of the new CryptoSettings class. The default configuration should work for every current implementation of this library.