Upon initial activation, Salesforce prompts the user to create an arbitrary passcode (if required by the org admin). The passcode is used to unlock the app after reboot, or an admin defined period of inactivity (1, 5, 10, or 30 minutes).
The passcode lock protects lost or stolen devices that have their wireless connection disabled, and can’t have their OAuth token revoked.
Passcode Strength and Storage
- Salesforce Mobile App for iOS: A PBKDF2 hash of the passcode is stored in the secure keychain, for passcode validation. The hashed passcode can be accessed only while the device is unlocked by the user (kSecAttrAccessibleWhenUnlockedThisDeviceOnly). The passcode is also used as a source of entropy for encryption operations within the app. Admins can configure the required passcode length through the Salesforce Connected App.
- Salesforce Mobile App for Android: PBKDF2 produced AES-256 encrypted key derived from a device unique Android ID and randomly generated string. Tokens (access and refresh) are stored in Android’s encrypted AccountManager. Admins can configure the required passcode length through the Salesforce Connected App.
An extra layer of security is provided when an admin enables passcode lock. Locally stored data is erased after 10 failed attempts at entering the passcode. Users are required to log in again to continue using the app.