2

I log into Wells Fargo's app with Face ID. But when I try to log in via the web, the password I have saved in iOS does not work (an old password, apparently).

I'm assuming that to log into the app, my password must be saved somewhere and transmitted to Wells Fargo. If I changed my password and iOS no longer has it, shouldn't I be unable to log in to the app even if my Face ID recognizes my face?

Improve this question

1 Answer 1

Reset to default
4

Your assumption is incorrect - it's not necessary for an app to know nor transmit your password to login to a service.

Usually authentication for these types of apps work by you logging with a password for the first login. The app is then issued a token, which you can think of as being a very long, single purpose password. For all future logins, the apps does not authenticate with your own password, but instead using that token.

This makes it possible for app developers to let you login using FaceID, TouchID and all sorts of other methods specifically without storing your own password on the device. In addition it allows them to give users the benefit that they can track which units are used to login, and to revoke the token (i.e. invalidate it) so that a specific device can no longer login (without further user authentication).

Improve this answer
4
  • It seems you must be right. I suppose the reason Wells' behavior seems strange is becuase other financial apps, after a password change, have forced me to sign on again with my password on iOS in order to re-enable Face ID. Perhaps that's a security protocol that Wells Fargo doesn't use while other finance app developers do, but which is not required by iOS in any case.
    – Buttle Butkus
    Commented Mar 9, 2021 at 0:33
  • There is no way that iOS could require it. It is entirely I. The hands of the application developer - there’s no way Apple can influence it. And yes, some companies choose that when you change your password, they invalidate all your tokens, others have chosen not to do so. For me it sounds like a good idea to at least give the user the opportunity to invalidate all or some of their tokens when they change passwords.
    – jksoegaard
    Commented Mar 9, 2021 at 0:46
  • That makes sense. I had assumed that the token was somehow tied to the password saved in iOS. But password-saving and the Face ID token are entirely separate, as I understand now. Thank you.
    – Buttle Butkus
    Commented Mar 9, 2021 at 1:10
  • 1
    There’s no relation between the password and the token. It’s not a “FaceID token” - the token itself has nothing to do with FaceID as such. It is just some data generated by the server - it is not made on the phone, nor is it made by Apple. The same tokens can be used for Android phones, Chromebooks and all sorts of other things.
    – jksoegaard
    Commented Mar 9, 2021 at 6:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .