[Bug] [1P8] "Face" unlock successfully enabled with fingerprint

nukmicah

On my Samsung Galaxy S21, I've only enabled fingerprint biometrics. 1P8 let me enable "Face" unlock, and now asks me to "Unlock with Face" whenever I open the app. Except I just scan my fingerprint and it works. So functionally it works, it's just misleading to say "Face" all over the place when I'm just using fingerprints.

ag_timothy

Hello @nukmicah thanks for testing out the early access and letting us know you've run into this issue!

It looks like if face and fingerprint unlock are available on a device the wording in 1Password 8 for Android defaults to face unlock, even if fingerprint unlock is being used. I can see we have an internal issue open for this and are investigating. Thanks again!

ref: dev/core/core#5801

DrRZ

I've experienced the same on my S22 Ultra. I haven't tried enabling face on my phone, so I'm not sure how 1Password handles when both Face and Fingerprint are enabled on the same device. However, if it doesn't already have this option, I think you should be able to select which is active and which should be the default. For instance, fingerprint should be significantly more secure on this phone so even if I've allowed unlocking by face, I might want to only allow fingerprint for 1Password.

ag_timothy

Hello @DrRZ thanks for following up with us!

For face or iris unlock, 1Password for Android requires devices to use Google's native Biometric framework as well as use strong encryption. To clarify, many devices have some sort of face or iris unlock option, but they don't support Google's native Biometric framework. Even if they do, they may not support strong encryption or include hardware such as a depth sensing IR camera or similar. To my knowledge, this support is limited to the Pixel 4, Pixel 4XL and a few other devices.

Assuming the S22 Ultra does not support all the requirements, you will not be able to use face unlock with 1Password even if it is available to unlock your device or other apps. If face unlock is available on your device, the wording in 1Password will default to face unlock (instead of biometric or finger print unlock) even if face unlock is not available with 1Password. If that's the case, tapping face unlock in Settings > Security will allow you to set up fingerprint unlock with 1Password. We're looking in to solutions to help make this more clear for 1Password users. Thanks again!

ethomp

Changing the terminology to biometric ID would be great. I, too, was initially thrown by the face unlock phrasing. For phones that support face unlock or fingerprint, it's not a big deal. (Unless fingerprint is the only option, in which case it would be really confusing...), For devices that support both fingerprint and face for biometric ID, it definitely implies that you need to enable the face unlock option.

The Samsung G22 series explicitly cautions that face unlock isn't as secure as fingerprint. Since it lacks the infrared/depth ability that's usually a requirement on iOS or Windows Hello unlock rather than just a selfie cam, I'm inclined to believe it.

ag_timothy

Hi @ethomp, I definitely agree the wording can be confusing at the moment, and that wasn't an intentional choice. To my understanding, if face unlock is available on your device (even if it wouldn't be accepted by 1Password as an unlock option) 1Password is registering that and defaulting to that wording rather than what is in use or possible to use.

While I don't have a timeline to share, this is something we plan to resolve in the future. Thanks for adding your thoughts!

ethomp

Actually, that's not what I'm seeing on 1P8 on a Galaxy 22 Ultra. I had fingerprint but not face enabled. 1P8 either didn't acknowledge that a biometric unlock option was available or didn't use it.

I added a face, and 1P8 picked up on both biometric methods.

If I delete the face (after reading the discussion here), the biometric unlock stops working. I add the face again, and it's fine.

This isn't the same as needing to re-enter the account password to get a valid random key again. Even after going through the steps that should enable it and toggling the setting in 1P8 and going through the steps, run doesn't work.

I did try the process multiple times.

ag_timothy

Hi @ethomp, with only fingerprints saved on your device what do you see Settings > Security > "biometric" unlock? Is the setting missing or grayed out? Perhaps with the changes in saved biometry a Keystore error has occurred. Thanks!

ethomp

Well, now I can't reproduce it. If memory serves, it allowed me to toggle the option, but it then prompted me to add a biometric unlock method. There was either an ok prompt or something similar that brought me to the Settings. I don't remember if it was all the way to the biometric options or not.

Now when I remove the credentials (fingerprints), the option is disabled.

I know that I was able to reproduce it at the time because I thought it was so weird that I had to keep trying it.

Now I'm wondering if it's possibly some confusion/mixup with work profiles and related apps.

I have applied a security update since I initially chimed in.

If it recurs or I'm able to reproduce it, I'll let you know.

imekachi

I'm using Galaxy S22 and enabled both face & fingerprint unlock. On 1P8, I went to Settings > Security I found only "Face unlock" option. I tried checking it but every time I use the autofill service, I still have to enter the password manually. No biometric unlock prompt at all.

Tried unchecking and rechecking the face unlock results in having to enter the password manually again. However, I tried clicking Lock to lock the app manually, now I can use biometric.

ankhazam

Hey, big issue here. Please fix it ASAP
Phone S21U with both fingers and face recorded.
1P8 allows me to unlock the app with my finger and face. I need to be able to make sure that only my finger works and my face won't accidentally unlock the app. I know it is possible as my banking app allows finger only.

ag_timothy

Hello @ankhazam, we have recently opened an issue for the behavior you described and our development team is working to get it resolved. Thanks for sharing your interest in this!

@imekachi, thanks for writing in. With 1Password 8 for Android, the app needs to be locked then unlocked with your account password after enabling face or fingerprint unlock to finish setup. I'm glad to hear you're up and running with biometric unlock now!

@ethomp, thanks for your reply. If you do see this issue pop up again, please let us know. We would be happy to investigate further.

Thanks again everyone!

ref: dev/core/core#16420

ankhazam

@ag_timothy cheers for the rapid and verbose response. Very much looking forward to this fix! :)

ag_timothy

@ankhazam I'm happy I could be of assistance! While I don't have any specifics on a timeline, I can see this issue has been marked as a high priority so hopefully we'll have a fix in the public beta in the not-so-distant future. Thanks again!

ankhazam

Hey, well... With 8.9.0 the app indeed does only unlock with fingerprint ;) not sure if it's on purpose or an accidental "bug" fix / satisfied feature as the unlock prompt says "unlock with face" <- that toast part is customisable by the dev and the security setting still name biometric unlock as "face unlock" ;)
Nonetheless this update made me happy as the app only accepts the password or my fingers ;)

ag_timothy

Hi @ankhazam I can confirm that a fix for this specific issue was included in the most recent update. Biometric unlock being labeled Face unlock on devices that have a facial scanner is a separate issue and one we're also working to fix but, understandably, it's a little lower on the list.

Thanks for following up with us about this, we really appreciate your feedback!