When i tried to open my Whatsapp chats from web browser on laptop, and wanted to scan a QR code from Whatsapp on my smartphone, Whatsapp asked for password, indide the same Whatsapp window. As i have found from https://faq.whatsapp.com/web/download-and-installation/how-to-log-in-or-out?lang=en , it asks for Android's screen lock password.

To log in to WhatsApp on WhatsApp Web, WhatsApp Desktop, or Portal, you need to use your phone to scan the QR code.

Android: Tap LINK A DEVICE. Follow the on-screen instructions if your device has biometric authentication. If you don’t have biometric authentication enabled, you’ll be prompted to enter the pin you use to unlock your phone.

Note: The authentication is handled by your device’s operating system using the biometrics stored there. WhatsApp can’t access the biometric information stored by your device's operating system.

Also I had seen similar behaviour with other apps, when app of a state service asked, in own window, for password of other state service.

I have found out that Facebook also used to allow for apps to ask for Facebook password in their windows:


We have been monitoring an uptick in phishing attempts on Android embedded browsers (also known as webviews), so beginning in August, we will no longer support FB Login authentication on Android embedded browsers.

If your app is using version 8.2+ of the SDK, we utilize several methods to authenticate the user through other methods -- including options like sending a push notification to verify the user’s identity (a.k.a. “Passwordless flow”) or asking the user to complete the login in the Chrome browser (Chrome Custom Tabs) or Facebook Android app (a.k.a. Android App Switch).

I have searched for Android docs and have found this:


I see there screenshots where dialog windows are shown, while all background is darkened, including Android's top panel... But seems this is a new version of Android, and I used Android 6.

Whith which Android version these separate dialog windows for authentication first appeared?

I checked for older version of this page, https://web.archive.org/web/20191002021720/https://developer.android.com/training/sign-in/biometric-auth , and i see there were same dialogs in 2019, no older archives.

What is Android's policy/recommendation on asking for password of other legal entities? I have seen https://developer.android.com/topic/security/best-practices and I did not see there any such recommendation. I think it is not secure, because, probably it is possible for a window to log any passwords entered in it.

  • Welcome to Android Enthusiasts, a Q&A site for Android end-users and power users (but not necessarily developers) solving their issues. While the question in the title can probably be answered, I'm not sure "What is Android's policy/recommendation on asking for password of other legal entities?" is on-topic because this isn't really what end-users have to think about.
    – Andrew T.
    Jan 12, 2022 at 15:21
  • 1
    @Robert since i am who does not know and therefore asks, i think, such mistakes are ok. answers should explain. i thought that biometric systems are together with pin code, password, graphical line systems, used interchangeably. since i saw android screen lock password prompt inside whatsapp's window, it is also was insecure in the same way, same policy/architecture/design fault.
    – qdinar
    Jan 12, 2022 at 17:21
  • 2
    Whatsapp can never ask for screen lock password, it can only trigger an screen lock password check (which may be shown above the app) but it will never get access to the password (unless it fakes the dialog but then it will not know if the password was correct).
    – Robert
    Jan 12, 2022 at 17:26
  • 1
    @Robert "which may be shown above the app". it is above when opened, but when i open list of running apps, the window is shown with whatsapp's title and the android's password prompt inside.
    – qdinar
    Jan 12, 2022 at 18:09
  • 1
    @wovano If you read the details about Android Gatekeeper the system component responsible for handling authentication attempts you will see that it runs in TEE and handles fingerprint, passwords, PINs and pattern. The Android API has API functions which can trigger an lock screen authentication (e.g. certain keys in AndroidKeystore) but to my knowledge there is no API that would allow to call it e.g. with the user password and then get back success/failed for the authentication.
    – Robert
    Feb 14, 2022 at 17:31


You must log in to answer this question.

Browse other questions tagged .