Is there an existing issue for this?

• I have searched the existing issues
• I have read the guide to filing a bug

Use case

Hi Flutter Community / @stuartmorgan,

We are looking for new flutter package that can match with the below requirement which is provided by Alaeddine Mesbahi who is from Ostorlab Team helping us to fix the Vulnerabilities in our application.

Issue:
#128722

Dev Recommendation:
Strong
As a Mobile Application developer, I am agreeing to the below use case that is very important for the mobile application to implement Biometric Authentication.

Use case:

Both the Biometric API on Android (BiometricPrompt.CryptoObject)[1] and iOS (kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly)[2] exposes APIs to secure data relying on cryptographic primitives that are either generated or unlocked using the Biometric authentication.

local_auth does not expose those. The fact that these APIs are part of the native SDK should naturally be reflected in its Flutter counterpart.

local_auth without it is insecure for use and Biometric authentication with it is always bypassable [3]. The risks addressed with Biometric Authentication are not mitigated as nothing links them to the Biometric data of the user.

[1] https://developer.android.com/reference/android/hardware/biometrics/BiometricPrompt.CryptoObject
[2] https://developer.apple.com/documentation/localauthentication/accessing_keychain_items_with_face_id_or_touch_id
[3] https://book.hacktricks.xyz/mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android

Proposal

To Summarize, Due to most of the application are using Biometric login implementation into the seem less login. I hope the Flutter team would reconsider adding these to the package and exposing the SDK cryptographic/access primitive to Dart for secure usage.