Show HN: A fork of sudo with Touch ID support • Hacker News Board

Re: Show HN: A fork of sudo with Touch ID support

#51

Post by dogma1138 » Mon, Oct 31, 2016, 9:04 AM UTC

zwp wrote: post #49

arnarbi wrote: post #21

Earlier quoted context omitted.

It's a "something you are" authentication factor, since it is presumed that the cost of faking a fingerprint is too high to be worth it in those cases.

https://www.schneier.com/crypto-gram/archives/2002/0515.html... "He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen. And he defeated eleven different commercial fingerprint readers, with both optical and capacitive sensors, and some with "live finger detection" features." That article's a little old now and the tech may well have improved since but I wouldn'…

The sensor is pretty good at detecting real finger since it's tuned to the capacitance of human skin, possible to fake but not particularly easy.

If they'll move to the new optical sensors the the refracted IR ones can sense the flow of blood in the veins of your finger.

Re: Show HN: A fork of sudo with Touch ID support

#52

Post by pritambaral » Mon, Oct 31, 2016, 9:15 AM UTC

CodeWriter23 wrote: post #47

yxhuvud wrote: post #42

Earlier quoted context omitted.

I wonder how much the cost will be reduced though considering that you will most probably be able to find a matching fingerprint on the same keyboard.

Use your thumb print.

Lift the thumbprint off of the TouchID sensor itself? That is, assuming the premise of the grandparent comment is valid and fingerprints lifted off of the keyboard would be enough.

Re: Show HN: A fork of sudo with Touch ID support

#53

Post by amelius » Mon, Oct 31, 2016, 9:17 AM UTC

jhgg wrote: post #26

jstoja wrote: post #23

Earlier quoted context omitted.

Can you elaborate? I'm not sure to understand the "ATM machine thing" and the "feels wrong on the lips".

ATM Machine = Automated Teller Machine Machine.

Ok, AT machine then, and PA module.

Re: Show HN: A fork of sudo with Touch ID support

#54

Post by throwanem » Mon, Oct 31, 2016, 9:40 AM UTC

pritambaral wrote: post #52

CodeWriter23 wrote: post #47

Earlier quoted context omitted.

Use your thumb print.

Lift the thumbprint off of the TouchID sensor itself? That is, assuming the premise of the grandparent comment is valid and fingerprints lifted off of the keyboard would be enough.

Slide, rather than raise, your thumb off the sensor.

Re: Show HN: A fork of sudo with Touch ID support

#55

Post by bhaak » Mon, Oct 31, 2016, 9:42 AM UTC

dvhh wrote: post #38

eshyong wrote: post #12

Earlier quoted context omitted.

I'm not sure that's true. Anyone can claim to be "rrmm" but only one person has that set of fingerprints.

"at a time", wasn't the movie "demolition man" showed us the physical danger of biometrics (/s)

No need for /s. That's a valid concern that gets mentioned often in discussions like this.

If a biometric sensor can be tricked by a body part that is no longer attached to the body, that's a serious issue. But AFAIK at least modern sensors try to verify if it's still alive and then there's also the biological effect that a body part quickly changes its properties if it is no longer supported by the body.

The biggest danger in that is probably criminals who don't know that it is likely that a detached body parts stops functioning.

Re: Show HN: A fork of sudo with Touch ID support

#56

Post by curun1r » Mon, Oct 31, 2016, 9:46 AM UTC

droopyEyelids wrote: post #11

You two are both doing the "ATM machine" thing. (PAM = Pluggable Authentication Module) "Written as a PAM" sure feels wrong on the lips, though.

When an acronym/initialism is ambiguous, you can repeat the last word to make what you're saying unambiguous. ATM machine is easily distinguished from ATM mode. Similarly, you could say a LEO orbit to distinguish from a LEO officer.

No matter what, it's not nearly as bad as "The Los Angeles Angels" :-)

Re: Show HN: A fork of sudo with Touch ID support

#57

Post by cromulent » Mon, Oct 31, 2016, 9:51 AM UTC

zwegner wrote: post #33

droopyEyelids wrote: post #11

You two are both doing the "ATM machine" thing. (PAM = Pluggable Authentication Module) "Written as a PAM" sure feels wrong on the lips, though.

Also known as PNS Syndrome (PIN Number Syndrome (Personal Identification Number Number Syndrome Syndrome)).

And RAS syndrome.

https://en.wikipedia.org/wiki/RAS_syndrome

Re: Show HN: A fork of sudo with Touch ID support

#58

Post by PetahNZ » Mon, Oct 31, 2016, 10:03 AM UTC

dogma1138 wrote: post #48

rrmm wrote: post #9

Earlier quoted context omitted.

I agree. But my thinking is that touch id just shows who the person claims to be (like a username), but it doesn't actually authenticate they are that person. I know that in practice apple does use it to auth.

TouchID sensor isn't that easy to fool with replicated fingerprints. If you are afraid that some one will cut off your finger to unlock your computer don't use the touchID, that said if some one is willing to do that to unlock it i wouldn't want to imagine what they'll do to you to get the password. ;)

You don't really need to cut their finger off. Just get them drunk enough to pass out.

Re: Show HN: A fork of sudo with Touch ID support

#59

Post by PetahNZ » Mon, Oct 31, 2016, 10:05 AM UTC

ajdlinux wrote: post #32

TekMol wrote: post #24

Earlier quoted context omitted.

What special "wrong thing" can root do? There might os level files that only root can edit or delete. I don't care about those. I can reinstall the os anytime if I should ever mess it up. All the value is in my data.

When you're doing maintenance on a production environment which is serving hundreds or thousands of customers, in many cases you can't just "reinstall the OS anytime". Sure, ideally your environment is set up with redundancy and you fail over nicely, but still...

To be fair, if you are serving hundreds or thousands of customers, I hope you have some form of redundancy.

Re: Show HN: A fork of sudo with Touch ID support

#60

Post by dancek » Mon, Oct 31, 2016, 10:12 AM UTC

seanp2k2 wrote: post #46

brazzledazzle wrote: post #7

Earlier quoted context omitted.

If I remember correctly you can use PAM modules on OS X as well. Perhaps writing one and integrating that with the touch ID button might be possible.

Guessing so since that's what Yubikey appears to do: https://www.yubico.com/support/knowledge-base/categories/art...

Yep, I've used the Yubikey PAM, and it works just fine. My first thought on seeing the title was: WHYYYYYY?

There are some slight usability issues with using custom PAM config. E.g. if you want to unlock the lock screen without password using the Yubikey, you still need to press enter.