How can the service be verified to be safe? Can it provide an idea? about react-native-biometrics HOT 1 CLOSED

This project is simply designed to make secure key generation and signing easier in react native. It uses the respective OS recommended approaches and system calls. All keystore access occurs in native code, and the generated private key reference can only be retrieved from the keystore by providing a valid fingerprint or face id, which is handled at the OS level by Android and iOS. The use of this library to sign information and the implementation of verifying that information server side is left up to you, and therefore the safety of those implementations are your responsibility. Here are some links that might be helpful:

https://android-developers.googleblog.com/2015/10/new-in-android-samples-authenticating.html
https://sushi2k.gitbooks.io/the-owasp-mobile-security-testing-guide/content/0x05f-Testing-Local-Authentication.html
https://sushi2k.gitbooks.io/the-owasp-mobile-security-testing-guide/content/0x06f-Testing-Local-Authentication.html

Note that this project has not been audited by a security agency so use it at your own risk. Please review the MIT license that this project is licensed under if you have any questions about liability.

from react-native-biometrics.