App lock

All four DigiFIR phone apps (citizen, police, lab and court) lock the same way and use the same words. The app PIN keeps out anyone who has only your phone.

The app PIN

• The PIN has six digits, typed on the app's own number pad.
• Easy PINs are refused: one digit repeated (000000) or a run up or down (123456, 654321, also wrapping round, such as 890123).
• You set it once at the end of set-up: Enter PIN, Enter it again, then Confirm PIN.
• The PIN never leaves the phone and never goes into a backup. Only a salted verifier of it is kept in the phone's secure storage. The citizen app uses a slow verifier (PBKDF2 with 100 000 rounds), so each guess by someone who copied the phone's storage costs real time.
• To change it, open Profile and tap Change app PIN. The current PIN comes first, so someone who picks up an unlocked phone cannot set a PIN of their own.

When the app asks for it

• At every start.
• When the app comes back after being away for the auto-lock time. Set it in Profile, Auto-lock: 1, 5 or 15 minutes, 5 by default. A phone clock set back to before the app went away locks at once.
• While the app is locked, nothing else opens. A notification tapped meanwhile opens its item after you unlock.

After unlocking, the staff apps open Home. On Android they first check that the official SIM is still in the phone, and show their SIM screen if it is not. The citizen app returns to the screen that was open, so a complaint being written stays where it was.

Wrong PINs

1. Each wrong PIN says how many tries are left, for example Wrong PIN · 4 tries left. The count survives closing the app.
2. A right PIN or a recognised fingerprint resets the count.

CAUTION

The fifth wrong PIN in a row signs the phone out, with the warning Too many wrong PINs. Nothing on the server is lost, but you must set up the phone again. Staff must enrol again with their registrar in person, and new enrolments of their code are held for a day.

Forgot PIN?

Forgot PIN? on the lock screen signs the phone out completely and starts set-up again:

• a citizen proves who they are again, with DigiLocker or at a police station, and keeps the same digital ID;
• staff enrol again with their institution's registrar, in person.

Then a new PIN is set. Every full sign-out turns fingerprint unlock off and sets the auto-lock back to 5 minutes. In the court app, Forgot PIN? also holds new enrolments of the officer's JO code for a day.

Fingerprint or Face ID

• It is off until you turn it on in Profile, Unlock with fingerprint. Turning it on asks for your fingerprint and your app PIN.
• When it is on, the lock screen asks for the fingerprint by itself. Use PIN goes back to the number pad. The phone's own screen-lock PIN is never accepted instead of the app PIN.
• A fingerprint that is not recognised does not count as a wrong PIN.

WARNING

The phone accepts any fingerprint enrolled on it, including one added later by someone who knows the phone's screen lock. If others know your phone's screen lock, leave fingerprint unlock off.

Privacy on the screen

App	Android	iPhone
Court	Screenshots and screen recording blocked in every build; blank in Recents	The app switcher, screen recordings and mirroring show the logo
Police, lab	Blocked in builds that run on the backend; blank in Recents	As above
Citizen	Blocked in builds that run on the backend, so screen-sharing apps that fraudsters ask victims to install record a black screen; blank in Recents. Receipts can still be saved with Download.	The app switcher shows the logo instead of a complaint

All four apps cover a signed-in session with the logo while it is in the background. Demo builds allow screenshots, for the app store listings.

The phone's signing key signs only while the phone itself is unlocked. At a cold start, the apps send nothing until the app PIN or fingerprint has been given.

The web portal

The citizen web portal has no app PIN and no fingerprint. A browser stays signed in while you use it, until Log out or 30 minutes without activity. Once every tab of the portal is closed, the next visit signs out and deletes that browser's key before anything is signed with it.

Source: docs/app-lock.md, identical in the four app repositories, on the migration branch.