Nice! Cool application of the touch bar. Much more practical than some of Apple's so far demoed examples. ;)
Show HN: A fork of sudo with Touch ID support
71–80 of 134 posts
Re: Show HN: A fork of sudo with Touch ID support
#72Earlier quoted context omitted.
What special "wrong thing" can root do? There might os level files that only root can edit or delete. I don't care about those. I can reinstall the os anytime if I should ever mess it up. All the value is in my data.
For most people, accidentally destroying various system files and "only" having to reinstall the OS would be considered a serious inconvenience. If you want an example of something that could cause lasting damage, it's probably pretty easy to put your Apple product into a non-booting state by fiddling with NVRAM or PRAM settings as root. I'm not familiar with them off the top of my head, though.
With the advent of EFI booting, you can brick basically any motherboard by wiping it's EFI partitions.
Re: Show HN: A fork of sudo with Touch ID support
#73I don't have one of the new macbooks, but wouldn't making a wrapper around the macOS authorization services thing do this as well?
Something like:
osascript -e "do shell script \"$*\" with administrator privileges"
Re: Show HN: A fork of sudo with Touch ID support
#74Earlier quoted context omitted.
If I remember correctly you can use PAM modules on OS X as well. Perhaps writing one and integrating that with the touch ID button might be possible.
Yes you can, at least you could 1 or 2 releases ago. I wrote one module and it worked perfectly. Edit: grammar
Do you have a link?
Re: Show HN: A fork of sudo with Touch ID support
#75Earlier quoted context omitted.
https://www.schneier.com/crypto-gram/archives/2002/0515.html... "He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen. And he defeated eleven different commercial fingerprint readers, with both optical and capacitive sensors, and some with "live finger detection" features." That article's a little old now and the tech may well have improved since but I wouldn'…
The sensor is pretty good at detecting real finger since it's tuned to the capacitance of human skin, possible to fake but not particularly easy. If they'll move to the new optical sensors the the refracted IR ones can sense the flow of blood in the veins of your finger.
They (including Apple) told us once too often that their new fingerprint sensor will now really, really, finally solve all issues. With every new generation they tell us that all flaws of all previous generations have been solved. And once too often, they we proven to be wrong.
So I agree with zwp (not sure why he was downvoted):
I wouldn't put too much faith in fingerprint readers.
Re: Show HN: A fork of sudo with Touch ID support
#76Nice! Cool application of the touch bar. Much more practical than some of Apple's so far demoed examples. ;)
Well they did have login and fast user switching as an example, so that's kinda comparable and probably more practical, considering "people using sudo" is a subset of "people logging in".
Also, I like how you can compliment the feature yet still insult its creator in single sentence.
Re: Show HN: A fork of sudo with Touch ID support
#77Why does macOS need sudo to boot?
It doesn't.
Re: Show HN: A fork of sudo with Touch ID support
#78I don't think this is very useful, at least in my usecase, where most things don't require sudo in the first place (homebrew installed DBs, etc.). Would be awesome to TouchID restart Upstart things on remotes, which is not really feasible. One can dream, though :)
Use the keychain to store your ssh keys, that's been possible since about 2007.
Re: Show HN: A fork of sudo with Touch ID support
#79This here is what gets me salivating: Using the toolbar as a context-sensitive test runner/controler: https://pbs.twimg.com/media/CwC8SNvW8AQgeWN.png:large
Re: Show HN: A fork of sudo with Touch ID support
#80Earlier quoted context omitted.
I agree. But my thinking is that touch id just shows who the person claims to be (like a username), but it doesn't actually authenticate they are that person. I know that in practice apple does use it to auth.
It's a "something you are" authentication factor, since it is presumed that the cost of faking a fingerprint is too high to be worth it in those cases.
Yeah, I'm not an international spy: even if it is 'easy', nobody is going to spend a few hours faking my fingerprint just to get into my phone or my laptop. And if they are so motivated, then there's a much bigger problem at hand.
There are plenty of people still using 4 digit passcode (especially simple ones like 0000 or 1234) which is easy to 'steal' by watching somebody unlock their phone before pickpocketing them.