How to use GitHub
- Please use the 👍 reaction to show that you are interested into the same feature.
- Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
- Subscribe to receive notifications on status change and new comments.
Feature request
Which Nextcloud Version are you currently using:
Nextcloud 34.0.2 / Passman server app 2.6.1 / Passman Android 1.6.0
Is your feature request related to a problem? Please describe.
Currently, when the "App start password" option is enabled, the app delegates authentication to the Android system via KeyguardManager.createConfirmDeviceCredentialIntent(). On most devices, if biometrics (fingerprint/face) are enrolled, the system prioritizes them. There is no in-app setting to restrict the authentication method to PIN/password only.
From a strict security perspective, this is a vulnerability for a password manager. Biometrics are inherently less secure than a strong PIN/password due to specific threat models, such as physical coercion (forced unlocking), legal compulsion to unlock a device via biometrics, or shared device environments (where family members have biometric access to the phone but shouldn't access the password vault).
PIN/Password security relies on "something you know" rather than "something you are", providing robust, undeniable protection against physical threats and unauthorized access.
Currently, to achieve this level of security, the only workaround is to completely delete all fingerprints from the Android system settings, which is highly inconvenient as it cripples the device's overall functionality.
Describe the solution you'd like
Add a dedicated setting under Settings -> Security that allows the user to explicitly enforce the authentication method for the app start. For example, a dropdown or radio buttons with:
- System default (current behavior, allows biometrics)
- PIN / Password / Pattern only (enforces device credential, strictly bypasses biometrics)
Technical suggestion:
This could be cleanly implemented by migrating from the deprecated KeyguardManager to the modern androidx.biometric.BiometricPrompt. By using setAllowedAuthenticators(Authenticators.DEVICE_CREDENTIAL) without including BIOMETRIC_STRONG or BIOMETRIC_WEAK, the app will force the Android system to prompt for the device PIN/password/pattern, completely and intentionally bypassing any enrolled biometric sensors.
Describe alternatives you've considered
Deleting all fingerprints/face data from Android system settings. This is unacceptable as a long-term solution because it affects the entire device and disables biometric unlock for all other non-critical apps and the system lock screen.
Additional context
This feature is standard in many top-tier password managers and privacy-focused apps, as it recognizes that a password vault requires a higher threat-model defense than a standard locked phone screen. Implementing this will significantly boost the security posture of Passman Android for privacy-conscious users.
How to use GitHub
Feature request
Which Nextcloud Version are you currently using:
Nextcloud 34.0.2 / Passman server app 2.6.1 / Passman Android 1.6.0
Is your feature request related to a problem? Please describe.
Currently, when the "App start password" option is enabled, the app delegates authentication to the Android system via
KeyguardManager.createConfirmDeviceCredentialIntent(). On most devices, if biometrics (fingerprint/face) are enrolled, the system prioritizes them. There is no in-app setting to restrict the authentication method to PIN/password only.From a strict security perspective, this is a vulnerability for a password manager. Biometrics are inherently less secure than a strong PIN/password due to specific threat models, such as physical coercion (forced unlocking), legal compulsion to unlock a device via biometrics, or shared device environments (where family members have biometric access to the phone but shouldn't access the password vault).
PIN/Password security relies on "something you know" rather than "something you are", providing robust, undeniable protection against physical threats and unauthorized access.
Currently, to achieve this level of security, the only workaround is to completely delete all fingerprints from the Android system settings, which is highly inconvenient as it cripples the device's overall functionality.
Describe the solution you'd like
Add a dedicated setting under
Settings -> Securitythat allows the user to explicitly enforce the authentication method for the app start. For example, a dropdown or radio buttons with:Technical suggestion:
This could be cleanly implemented by migrating from the deprecated
KeyguardManagerto the modernandroidx.biometric.BiometricPrompt. By usingsetAllowedAuthenticators(Authenticators.DEVICE_CREDENTIAL)without includingBIOMETRIC_STRONGorBIOMETRIC_WEAK, the app will force the Android system to prompt for the device PIN/password/pattern, completely and intentionally bypassing any enrolled biometric sensors.Describe alternatives you've considered
Deleting all fingerprints/face data from Android system settings. This is unacceptable as a long-term solution because it affects the entire device and disables biometric unlock for all other non-critical apps and the system lock screen.
Additional context
This feature is standard in many top-tier password managers and privacy-focused apps, as it recognizes that a password vault requires a higher threat-model defense than a standard locked phone screen. Implementing this will significantly boost the security posture of Passman Android for privacy-conscious users.