将用户凭据存储在钥匙串中以使用touchid登录有多安全？

Question

I want to implement authentication mechanism with touchid to my mobile application. My plan is that upon user successful login I will save his credentials to the keychain, and next time he goes to my application I will fetch the credentials from the keychain and let him login after successful touchid match.

I was wondering if this is safe to save his password inside the keychain. What could happen if the device is jail broken? Is there any alternative to saving his password in the keychain?

Thank you!

Answer 1

The keychain is the safest place to store your user's credentials. You have the right idea with your implementation. When you save something in the keychain on iOS, it's encrypted and safely stored by the system, which is safer than you handling encryption yourself

Answer 2

It is safe to save credentials in the keychain. Here is evidence backing this up from Apple documentation.

By making a single call to this API, an app can store small bits of secret information on a keychain, from which the app can later retrieve the information—also with a single call. The keychain secures data by encrypting it before storing it in the file system, relieving you of the need to implement complicated encryption algorithms.

Further information about storing other things:

In addition to passwords, keychains also store cryptographic keys, certificates, and (in macOS) text strings (notes).

Source: https://developer.apple.com/library/content/documentation/Security/Conceptual/keychainServConcepts/02concepts/concepts.html