Android: minimize, exit app, ask for second tap or ignore?

Question

I am developing a password manager app that requires the user to enter a pin when the app starts. Resuming the app from background either asks for pin or fingerprint. There is also a settings option configuring a grace period that allows the user to skip authentication if the app resumes before a certain amount of time passed since it was sent into background.

The app has three root views (lists): accounts, cards and notes. From each of these views the user can navigate further, into item detail, add/edit, etc. When tapping the system back button, the user navigates back the hierarchy until reaching one of these root views.

I am unsure what to do when the user taps the back button from any of these root views. Technically and by default, the app should exit (and it does, unless I come up with a different implementation). However, I find exiting the app is less than ideal, as this means the user has to reenter the pin the next time the app is accessed (from recent apps, for example). More, it interferes in a confusing way with the option to skip authentication when the app resumes, regular users not making much of a difference between starting an app fresh or resuming it.

So, I thought of some alternatives:

1. Ignore the user action
2. Display a toast requesting the user to tap a second time to exit the app
3. Minimize the app instead of exiting

I am mostly inclined towards the third option.

What are your thoughts from a UX perspective?

Thank you!

Answer 1

Ignoring the action or requesting a second tap to exit would be inconsistent with the standard behavior of apps on Android. I'd recommend against that, as it's likely to annoy users.

As for whether to "minimize the app", the question here really is whether to maintain unlocked state on back action exit or not. That's both a UX question and a security question. Let's examine the possibilities:

1. Keep account unlocked on back action exit. This takes away the potential pain of having to log back in. It's hard to say whether the user would expect the app to lock or not, I personally wouldn't. For users that need certainty that the app is locked, I'd recommend adding an easily discoverable "Lock" action. As leaving the app unlocked can be a big security problem, it might also be worth it to let the user know it's unlocked via a notification. (Much like browsers show a notification when the user has private tabs open.)
2. Lock account on back action exit. This is certainly the most secure option, but also potentially annoying if triggered by accident. If these accidents are common, users would be likely to have bad associations with your app.
3. Keep user logged in on exit in general, given a grace period. You mention this is a setting. As most people stick with defaults, it's worth considering making this a default. For example, a 1 min grace period should be more than enough for a person who accidentally closed the app to get back into it, but should pose a relatively minor security threat compared to just leaving it unlocked in general. Moreover, it also makes leaving the app predictable. As many users don't make a distinction between "minimizing" and app and closing an app, this could potentially be a security win in general — even users accustomed to minimizing rather than closing an app would get their app locked.

I'd personally go for option 3.

Also, if accidentally closing the app via the back button is common, it'd also be worth examining why. Perhaps there's something misleading on the screen implying there's something one level higher? (I've personally seen this happen with navigation drawers — would recommend using bottom navigation instead.)