Show HN: A fork of sudo with Touch ID support
1–10 of 134 posts
Re: Show HN: A fork of sudo with Touch ID support
#2This sounds amazing, and Id love if Apple allowed touchid for regular account-password prompts in macOS 10.13 (or a Sierra point update but let's be realistic)
If they integrated this down to the built in sudo/su that would be even more amazing, but I imagine that's much less likely.
Re: Show HN: A fork of sudo with Touch ID support
#3Similar: On Linux, doing something like this doesn't require patched sudo. sudo uses the OS provided auth framework (PAM), which is pluggable (the 'P' in 'PAM' stands for 'Pluggable'); and fprintd provides a pam plugin.
The `LocalAuthentication` framework this project mentions sounds like an OS X equivalent of PAM — an OS level account auth framework. I wonder why/if the `sudo` on OS X doesn't use it.
Re: Show HN: A fork of sudo with Touch ID support
#4Shouldn't touch ID be the userid and not the password?
Re: Show HN: A fork of sudo with Touch ID support
#5This sounds amazing, and Id love if Apple allowed touchid for regular account-password prompts in macOS 10.13 (or a Sierra point update but let's be realistic) If they integrated this down to the built in sudo/su that would be even more amazing, but I imagine that's much less likely.
I haven't tried the new MBP but this was how I assumed it worked... On iOS you just need to enter your password when the device first boots, then you can use TouchID to authenticate for almost everything where you would use your password.
Re: Show HN: A fork of sudo with Touch ID support
#6Shouldn't touch ID be the userid and not the password?
Okay, so there's two requirements for any legit authorization to pass: identification, and authentication. For Unix accounts, the username is the identification bit, and the password is the authentication bit.
Now, you don't usually type the username when you run sudo, do you? That's because most of the time, the username can be gleaned from context. For example, "Which user is this process running under?".
So, if TouchID's purpose was just to supply identification and not any verification that the identification is legit, that would be pretty pointless.
Re: Show HN: A fork of sudo with Touch ID support
#7Similar: On Linux, doing something like this doesn't require patched sudo. sudo uses the OS provided auth framework (PAM), which is pluggable (the 'P' in 'PAM' stands for 'Pluggable'); and fprintd provides a pam plugin. The `LocalAuthentication` framework this project mentions sounds like an OS X equivalent of PAM — an OS level account auth framework. I wonder why/if the `sudo` on OS X doesn't use it.
If I remember correctly you can use PAM modules on OS X as well. Perhaps writing one and integrating that with the touch ID button might be possible.
Re: Show HN: A fork of sudo with Touch ID support
#8Similar: On Linux, doing something like this doesn't require patched sudo. sudo uses the OS provided auth framework (PAM), which is pluggable (the 'P' in 'PAM' stands for 'Pluggable'); and fprintd provides a pam plugin. The `LocalAuthentication` framework this project mentions sounds like an OS X equivalent of PAM — an OS level account auth framework. I wonder why/if the `sudo` on OS X doesn't use it.
If I remember correctly you can use PAM modules on OS X as well. Perhaps writing one and integrating that with the touch ID button might be possible.
Oh, then OSX's sudo has little reason to not use PAM. In which case, this project would be better written as a PAM module instead of a sudo fork.
Re: Show HN: A fork of sudo with Touch ID support
#9Shouldn't touch ID be the userid and not the password?
Okay, so there's two requirements for any legit authorization to pass: identification, and authentication. For Unix accounts, the username is the identification bit, and the password is the authentication bit. Now, you don't usually type the username when you run sudo, do you? That's because most of the time, the username can be gleaned from context. For example, "Which user is this process running under?". So, if To…
I agree. But my thinking is that touch id just shows who the person claims to be (like a username), but it doesn't actually authenticate they are that person.
I know that in practice apple does use it to auth.
Re: Show HN: A fork of sudo with Touch ID support
#10Rather than calling it suto, the author could just use the PATH env variable in .profile
I don't think the system would have much problem with that since profile is explicitly for interactive user sessions.