Biometric Authentication: FaceID and TouchID Integration

Whistl requires biometric authentication to access sensitive financial data and settings. This comprehensive guide explains LocalAuthentication framework integration, FaceID and TouchID implementation, fallback mechanisms, and how biometrics protect your data while providing seamless user experience.

Why Biometric Authentication?

Financial apps require strong authentication:

• Security: Biometrics can't be guessed or phished
• Convenience: No passwords to remember
• Speed: Authentication in under 1 second
• Privacy: Biometric data never leaves device

Whistl uses biometrics to protect access to transactions, settings, and protected features.

Biometric Authentication Flow

Whistl's authentication flow balances security with usability:

Authentication Triggers

• App launch: Required after background or reinstall
• Settings access: Viewing sensitive configuration
• Bank connection: Adding or modifying accounts
• Protected floor change: Modifying spending limits
• Partner settings: Accountability configuration

Authentication Options

LocalAuthentication Framework

iOS provides LocalAuthentication for biometric authentication:

Capability Check

import LocalAuthentication

class BiometricAuthenticator {
    private let context = LAContext()
    
    func canAuthenticate() -> (Bool, LAPolicy, String?) {
        var error: NSError?
        
        // Check FaceID/TouchID availability
        if context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error) {
            let biometryType = context.biometryType
            switch biometryType {
            case .faceID:
                return (true, .deviceOwnerAuthenticationWithBiometrics, "FaceID")
            case .touchID:
                return (true, .deviceOwnerAuthenticationWithBiometrics, "TouchID")
            case .none:
                return (false, .deviceOwnerAuthentication, nil)
            @unknown default:
                return (false, .deviceOwnerAuthentication, nil)
            }
        }
        
        // Fall back to passcode
        if context.canEvaluatePolicy(.deviceOwnerAuthentication, error: &error) {
            return (true, .deviceOwnerAuthentication, "Passcode")
        }
        
        return (false, .deviceOwnerAuthentication, nil)
    }
}

Authentication Request

func authenticate(reason: String) async -> Bool {
    let (canAuth, policy, _) = canAuthenticate()
    guard canAuth else { return false }
    
    do {
        let success = try await context.evaluatePolicy(
            policy,
            localizedReason: reason
        )
        return success
    } catch LAError.userCancel {
        // User cancelled - don't retry
        return false
    } catch LAError.userFallback {
        // User chose passcode - system handles
        return true
    } catch LAError.biometryNotAvailable {
        // Biometrics unavailable - fall back to passcode
        return await authenticateWithPasscode()
    } catch {
        return false
    }
}

Custom Localized Reason

Whistl provides context-specific authentication reasons:

func getAuthenticationReason(for action: AuthAction) -> String {
    switch action {
    case .appLaunch:
        return "Authenticate to access Whistl"
    case .viewTransactions:
        return "Authenticate to view transaction history"
    case .modifySettings:
        return "Authenticate to change security settings"
    case .connectBank:
        return "Authenticate to connect bank account"
    case .changeProtectedFloor:
        return "Authenticate to modify spending protection"
    case .viewPartnerData:
        return "Authenticate to view accountability partner data"
    }
}

FaceID Implementation

FaceID uses TrueDepth camera for facial recognition:

FaceID-Specific Configuration

class FaceIDAuthenticator: BiometricAuthenticator {
    override func configure() {
        // FaceID-specific settings
        context.localizedFallbackTitle = "Use Passcode"
        context.localizedCancelTitle = "Cancel"
        
        // FaceID works in landscape
        context.supportsFaceIDOrientation = true
    }
    
    // Handle FaceID-specific errors
    override func handleError(_ error: LAError) {
        switch error.code {
        case .faceIDDisabled:
            showSetupMessage("FaceID is disabled. Enable in Settings.")
        case .faceIDNotEnrolled:
            showSetupMessage("No face enrolled. Set up FaceID first.")
        case .faceIDLockout:
            showSetupMessage("Too many failed attempts. Use passcode.")
        case .systemCancel:
            // Another app used FaceID - retry
            retryAuthentication()
        default:
            break
        }
    }
}

FaceID in Info.plist

<key>NSFaceIDUsageDescription</key>
<string>Whistl uses FaceID to protect your financial data and ensure only you can access sensitive settings.</string>

TouchID Implementation

TouchID uses fingerprint sensor for authentication:

TouchID-Specific Configuration

class TouchIDAuthenticator: BiometricAuthenticator {
    override func configure() {
        // TouchID-specific settings
        context.localizedFallbackTitle = "Use Passcode"
        context.localizedCancelTitle = "Cancel"
    }
    
    // Handle TouchID-specific errors
    override func handleError(_ error: LAError) {
        switch error.code {
        case .touchIDDisabled:
            showSetupMessage("TouchID is disabled. Enable in Settings.")
        case .touchIDNotEnrolled:
            showSetupMessage("No fingerprint enrolled. Set up TouchID first.")
        case .touchIDLockout:
            showSetupMessage("Too many failed attempts. Use passcode.")
        case .touchIDNotAvailable:
            // Device restarted - TouchID unavailable until passcode used
            showSetupMessage("Use passcode after restart.")
        default:
            break
        }
    }
}

Android BiometricPrompt

Android uses BiometricPrompt API for authentication:

BiometricPrompt Implementation

import androidx.biometric.BiometricPrompt

class BiometricAuthenticator(private val activity: FragmentActivity) {
    
    fun canAuthenticate(): Boolean {
        return BiometricManager.from(activity).canAuthenticate(
            BiometricManager.Authenticators.BIOMETRIC_STRONG or
            BiometricManager.Authenticators.DEVICE_CREDENTIAL
        ) == BiometricManager.BIOMETRIC_SUCCESS
    }
    
    fun authenticate(reason: String, callback: (Boolean) -> Unit) {
        val executor = ContextCompat.getMainExecutor(activity)
        
        val prompt = BiometricPrompt(activity, executor, 
            object : BiometricPrompt.AuthenticationCallback() {
                override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
                    callback(true)
                }
                
                override fun onAuthenticationFailed() {
                    // Try again
                }
                
                override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
                    if (errorCode == BiometricPrompt.ERROR_USER_CANCELED) {
                        callback(false)
                    }
                }
            }
        )
        
        val promptInfo = BiometricPrompt.PromptInfo.Builder()
            .setTitle("Whistl Authentication")
            .setSubtitle(reason)
            .setNegativeButtonText("Use Passcode")
            .setAllowedAuthenticators(
                BiometricManager.Authenticators.BIOMETRIC_STRONG or
                BiometricManager.Authenticators.DEVICE_CREDENTIAL
            )
            .build()
        
        prompt.authenticate(promptInfo)
    }
}

Session Management

After authentication, Whistl maintains a secure session:

Session Configuration

class AuthSession {
    private var authenticatedUntil: Date?
    private let sessionDuration: TimeInterval = 300  // 5 minutes
    
    func markAuthenticated() {
        authenticatedUntil = Date().addingTimeInterval(sessionDuration)
    }
    
    func isAuthenticated() -> Bool {
        guard let until = authenticatedUntil else { return false }
        return Date() < until
    }
    
    func invalidate() {
        authenticatedUntil = nil
    }
    
    // Auto-invalidate on background
    func handleAppBackground() {
        // Shorten session when app backgrounds
        if let until = authenticatedUntil {
            authenticatedUntil = Date().addingTimeInterval(60)  // 1 minute
        }
    }
}

Background Invalidation

class AppDelegate: UIResponder, UIApplicationDelegate {
    func applicationDidEnterBackground(_ application: UIApplication) {
        // Invalidate sensitive views
        AuthSession.shared.invalidate()
        
        // Blur screen for privacy
        WindowManager.shared.addPrivacyBlur()
    }
    
    func applicationWillEnterForeground(_ application: UIApplication) {
        // Remove privacy blur
        WindowManager.shared.removePrivacyBlur()
        
        // Require re-authentication
        if !AuthSession.shared.isAuthenticated() {
            showAuthentication()
        }
    }
}

Privacy Screen Protection

Whistl protects sensitive data from shoulder surfing:

iOS Privacy Screen

class PrivacyWindowManager {
    private var privacyView: UIVisualEffectView?
    
    func addPrivacyBlur() {
        guard privacyView == nil else { return }
        
        let blurEffect = UIBlurEffect(style: .systemUltraThinMaterial)
        privacyView = UIVisualEffectView(effect: blurEffect)
        privacyView?.frame = UIScreen.main.bounds
        privacyView?.autoresizingMask = [.flexibleWidth, .flexibleHeight]
        
        UIApplication.shared.windows.first?.addSubview(privacyView!)
    }
    
    func removePrivacyBlur() {
        privacyView?.removeFromSuperview()
        privacyView = nil
    }
}

Android FLAG_SECURE

class SecurityActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        
        // Prevent screenshots and screen recording
        window.setFlags(
            WindowManager.LayoutParams.FLAG_SECURE,
            WindowManager.LayoutParams.FLAG_SECURE
        )
    }
    
    override fun onPause() {
        super.onPause()
        // Blur content when in recents
        addBlurToWindow()
    }
    
    override fun onResume() {
        super.onResume()
        removeBlurFromWindow()
    }
}

Error Handling

Graceful handling of authentication failures:

Error Recovery

Accessibility Support

Biometric authentication supports accessibility features:

• VoiceOver: Announces authentication prompts
• Switch Control: Alternative input methods
• Guided Access: Works with accessibility restrictions

Security Considerations

Biometric authentication has important security implications:

Best Practices

• Never store biometric data: Only use system APIs
• Always provide fallback: Passcode for accessibility
• Timeout sessions: Require re-authentication periodically
• Invalidate on background: Protect when app not active
• Log failures: Track suspicious authentication patterns

Performance Metrics

Biometric authentication performance:

User Testimonials

"FaceID makes opening Whistl instant. No passwords to remember, just glance and I'm in." — Emma, 26

"I love that my financial data is protected by the same security as my phone. Feels safe." — Marcus, 28

"TouchID works perfectly even with slightly wet fingers. Never had it fail on me." — Jake, 31

Conclusion

Biometric authentication provides strong security with seamless user experience. Through LocalAuthentication on iOS and BiometricPrompt on Android, Whistl protects sensitive financial data while keeping access fast and convenient.

Your biometric data never leaves your device—authentication happens entirely in the secure enclave.

Related: Local Storage Encryption | Plaid Bank Integration Security | Cloud Sync with E2E Encryption