sudo-touchid
Security and privacy
authentication tooling
SHOW HN2016
How HN took it
6 positive, 25 neutral or asking, 0 mixed, 17 critical, out of 48 comments about the project. Thread score -0.16.
Idea: 4 for, 6 againstPrivacy: 0 for, 6 againstDesign: 1 for, 2 againstPerformance: 1 for, 1 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Sounds useful and a practical use of the Touch Bar and Touch ID
From 3 comments
This sounds amazing, and Id love if Apple allowed touchid for regular account-password prompts in macOS 10.13 (or a Sierra point update but let's be realistic) If they integrated…
stephenr on HNNice! Cool application of the touch bar. Much more practical than some of Apple's so far demoed examples. ;)
oniyokai on HNI love this. Should buy a new MacBook just to be able to use this :D
GiovanniFrigo on HN
Similar Touch ID or biometric auth exists on Windows Hello and Linux fprintd
From 2 comments
The Surface line-up provides a similar feature for User Access Control (UAC) prompts via Windows Hello facial recognition (or the available fingerprint scanner for older…
bhauer on HNSimilar: On Linux, doing something like this doesn't require patched sudo. sudo uses the OS provided auth framework (PAM), which is pluggable (the 'P' in 'PAM' stands for…
pritambaral on HN
Objections
Fingerprints can be lifted or spoofed and are weak authentication
From 3 comments
Be mindful that it is not hard to lift fingerprints to trick that authentication method. Most specially, in an office environment it can be done from a mouse, a keyboard, a glass…
partycoder on HNhttps://www.schneier.com/crypto-gram/archives/2002/0515.html#5 "He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen.…
zwp on HN"could be as simple as taking a photo" I don't buy this story or their "sources" at all. A zoomed in photo is enough to create a accurate 3d model? Really? I might be naive at…
mkhalil on HN
Fingerprints are identifiers, not secrets, so they should not authenticate
From 3 comments
Shouldn't touch ID be the userid and not the password?
rrmm on HNFingerprints are user names, not passwords.
jwatte on HNI think the gp was alluding to an argument originally from this blog post [1], which posits that biometrics should only be used to identify, and should never be used to…
dragonshed on HN
DYLD injection could bypass the LocalAuthentication check
From 1 comment
I have a feeling this is EXTREMELY DANGEROUS to have on your Mac. Using DYLD_INSERT_LIBRARIES and attacker could inject code that swizzles -[LAContext evaluatePolicy:…
sjtgraham on HN
Not useful for most users since most commands do not need sudo
From 1 comment
I don't think this is very useful, at least in my usecase, where most things don't require sudo in the first place (homebrew installed DBs, etc.). Would be awesome to TouchID…
elmigranto on HN
Requests
Touch ID support for system password prompts and su
From 1 comment
This sounds amazing, and Id love if Apple allowed touchid for regular account-password prompts in macOS 10.13 (or a Sierra point update but let's be realistic) If they integrated…
stephenr on HN
Touch ID for remote sudo or other OS prompts
From 1 comment
I don't think this is very useful, at least in my usecase, where most things don't require sudo in the first place (homebrew installed DBs, etc.). Would be awesome to TouchID…
elmigranto on HN
Questions
Why not use the macOS authorization framework or PAM instead
From 2 comments
Similar: On Linux, doing something like this doesn't require patched sudo. sudo uses the OS provided auth framework (PAM), which is pluggable (the 'P' in 'PAM' stands for…
pritambaral on HNI don't have one of the new macbooks, but wouldn't making a wrapper around the macOS authorization services thing do this as well? Something like: osascript -e "do shell script…
bonyt on HN
Why does sudo exist instead of running as root
From 1 comment
I never understood the obsession with sudo. Why not just be root in the first place?
TekMol on HN
Alternatives named
Linux PAM with fprintd
From 1 comment
Similar: On Linux, doing something like this doesn't require patched sudo. sudo uses the OS provided auth framework (PAM), which is pluggable (the 'P' in 'PAM' stands for…
pritambaral on HN
Windows Hello for UAC prompts
From 1 comment
The Surface line-up provides a similar feature for User Access Control (UAC) prompts via Windows Hello facial recognition (or the available fingerprint scanner for older…
bhauer on HN
osascript with administrator privileges
From 1 comment
I don't have one of the new macbooks, but wouldn't making a wrapper around the macOS authorization services thing do this as well? Something like: osascript -e "do shell script…
bonyt on HN