Operation success after failed biometry in offline

[kober32]

When requesting authentication with biometry (for example PowerAuth.authenticateUsingBiometry call on Android), the request will call success callback (with dummy data) when the biometry fails after several failed attempts on both iOS and Android (when the system will just dismiss the dialog with something like "too many failed attempts").

This behavior is OK when you're calling the server with the result, which will reject the request and thus will raise the fail counter.

But it's not OK for offline authentication when there is no server verification and the user is just presented with the wrong output in the end.

This could be solved with adding a flag to the call, telling the SDK that the returned data won't be verified by the server, or the callback object (IBiometricAuthenticationCallback in Android) could be extended with a new method - something like onBiometryDialogTooManyAttempts, or onBiometricDialogFailed could be used with some specific exception.

[hvge]

This needs to be considered properly. I understand that the requested behavior is good for the user's experience, but not for the security.

Changing from bug to enhancement.