41–50 of 134 posts
You two are both doing the "ATM machine" thing. (PAM = Pluggable Authentication Module) "Written as a PAM" sure feels wrong on the lips, though.
Can you elaborate? I'm not sure to understand the "ATM machine thing" and the "feels wrong on the lips".
Earlier quoted context omitted.
I agree. But my thinking is that touch id just shows who the person claims to be (like a username), but it doesn't actually authenticate they are that person. I know that in practice apple does use it to auth.
It's a "something you are" authentication factor, since it is presumed that the cost of faking a fingerprint is too high to be worth it in those cases.
This sounds amazing, and Id love if Apple allowed touchid for regular account-password prompts in macOS 10.13 (or a Sierra point update but let's be realistic) If they integrated this down to the built in sudo/su that would be even more amazing, but I imagine that's much less likely.
It is already the case. In the keynote, they demoed Fast User Switch with a touch of finger. If multiple people share a single computer, switching to the right user account is a touch away.
Similar: On Linux, doing something like this doesn't require patched sudo. sudo uses the OS provided auth framework (PAM), which is pluggable (the 'P' in 'PAM' stands for 'Pluggable'); and fprintd provides a pam plugin. The `LocalAuthentication` framework this project mentions sounds like an OS X equivalent of PAM — an OS level account auth framework. I wonder why/if the `sudo` on OS X doesn't use it.
If I remember correctly you can use PAM modules on OS X as well. Perhaps writing one and integrating that with the touch ID button might be possible.
Edit: grammar
Shouldn't touch ID be the userid and not the password?
I'm not sure that's true. Anyone can claim to be "rrmm" but only one person has that set of fingerprints.
Similar: On Linux, doing something like this doesn't require patched sudo. sudo uses the OS provided auth framework (PAM), which is pluggable (the 'P' in 'PAM' stands for 'Pluggable'); and fprintd provides a pam plugin. The `LocalAuthentication` framework this project mentions sounds like an OS X equivalent of PAM — an OS level account auth framework. I wonder why/if the `sudo` on OS X doesn't use it.
If I remember correctly you can use PAM modules on OS X as well. Perhaps writing one and integrating that with the touch ID button might be possible.
Earlier quoted context omitted.
It's a "something you are" authentication factor, since it is presumed that the cost of faking a fingerprint is too high to be worth it in those cases.
I wonder how much the cost will be reduced though considering that you will most probably be able to find a matching fingerprint on the same keyboard.
Earlier quoted context omitted.
Okay, so there's two requirements for any legit authorization to pass: identification, and authentication. For Unix accounts, the username is the identification bit, and the password is the authentication bit. Now, you don't usually type the username when you run sudo, do you? That's because most of the time, the username can be gleaned from context. For example, "Which user is this process running under?". So, if To…
I agree. But my thinking is that touch id just shows who the person claims to be (like a username), but it doesn't actually authenticate they are that person. I know that in practice apple does use it to auth.
If you are afraid that some one will cut off your finger to unlock your computer don't use the touchID, that said if some one is willing to do that to unlock it i wouldn't want to imagine what they'll do to you to get the password.
;)
Earlier quoted context omitted.
I agree. But my thinking is that touch id just shows who the person claims to be (like a username), but it doesn't actually authenticate they are that person. I know that in practice apple does use it to auth.
It's a "something you are" authentication factor, since it is presumed that the cost of faking a fingerprint is too high to be worth it in those cases.
"He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen. And he defeated eleven different commercial fingerprint readers, with both optical and capacitive sensors, and some with "live finger detection" features."
That article's a little old now and the tech may well have improved since but I wouldn't put too much faith in fingerprint readers. (Also: other attack vectors exist).