Use Touch ID for Sudo on Mac • Hacker News Board

Re: Use Touch ID for Sudo on Mac

#11

Post by mega_dingus » Mon, Mar 01, 2021, 1:37 PM UTC

bitlevel wrote: post #8

The article will not allow sudo changes on Big Sur - at least, not without changing permissions of the sudo file first: 1. sudo -Si 2. chmod 644 /etc/pam.d/sudo 3. vi /etc/pam.d/sudo 4. Add the 'Auth sufficient pam_tid.so' line 5. chmod 444 /etc/pam.d/sudo 6. ... 7. Profit! Very handy tip though, thanks!

Or when using vi, just use :wq!

Re: Use Touch ID for Sudo on Mac

#12

Post by dmitriid » Mon, Mar 01, 2021, 1:38 PM UTC

rvz wrote: post #2

Very handy. But you can use your Apple Watch for sudo which is even better: [0] [0] https://github.com/insidegui/pam-watchid

I'd love for iPhone and Watch to serve as a second-screen touch id for MacOS. Then I can tuck the laptop (or Mini) away, and not have to type passwords into various systems.

Re: Use Touch ID for Sudo on Mac

#13

Post by gumby » Mon, Mar 01, 2021, 1:45 PM UTC

As the author says, “Since you expect to be be typing in a command line, moving your finger to touch the key is probably not very efficient.”

I was excited to set this up when the first fingerprint sensor macs came out. Within a couple of days I’d switched it off. It is quite inconvenient and especially bad if you use an external keyboard.

Re: Use Touch ID for Sudo on Mac

#14

Post by macintux » Mon, Mar 01, 2021, 1:45 PM UTC

nindalf wrote: post #9

Simplicitas wrote: post #6

Author admits 'probably not very efficient', but still a great SHORT article to consider something interesting. Thanks

I'm not sure about the "not efficient" part either. My password is 10+ characters, random alphanumeric with special characters. I sometimes mistype it. Whereas I'm yet to make a mistake tapping my finger on the finger print reader.

My current passphrase for work is 55 characters, so yeah, I could definitely see using this hack if I had to use sudo often.

(I'll probably shorten it soon, but it's a slightly mangled lyric from a popular song, so it's easy enough to remember.)

Re: Use Touch ID for Sudo on Mac

#15

Post by deergomoo » Mon, Mar 01, 2021, 1:46 PM UTC

rvz wrote: post #2

Very handy. But you can use your Apple Watch for sudo which is even better: [0] [0] https://github.com/insidegui/pam-watchid

If you have a Touch ID Mac, enabling Touch ID for sudo also enables using an Apple Watch, so you can use either if you like.

Re: Use Touch ID for Sudo on Mac

#16

Post by zaphirplane » Mon, Mar 01, 2021, 1:47 PM UTC

bitlevel wrote: post #8

The article will not allow sudo changes on Big Sur - at least, not without changing permissions of the sudo file first: 1. sudo -Si 2. chmod 644 /etc/pam.d/sudo 3. vi /etc/pam.d/sudo 4. Add the 'Auth sufficient pam_tid.so' line 5. chmod 444 /etc/pam.d/sudo 6. ... 7. Profit! Very handy tip though, thanks!

I don’t get it, the article shows it in 2 steps why the 5 step verbosity??

Re: Use Touch ID for Sudo on Mac

#17

Post by gumby » Mon, Mar 01, 2021, 1:47 PM UTC

rvz wrote: post #2

Very handy. But you can use your Apple Watch for sudo which is even better: [0] [0] https://github.com/insidegui/pam-watchid

You have to take your fingers off the keyboard for this which is a big distractor, worse than using a mouse.

I use this feature for other touch cases (e.g. unlocking 1Password) but would hate it when in the flow.

Admittedly my password is well wired into my fingers.

Re: Use Touch ID for Sudo on Mac

#18

Post by deergomoo » Mon, Mar 01, 2021, 1:48 PM UTC

fluder wrote: post #4

And with every macOS update you should do it again and again. Just another not useful tip.

I disagree that it's not useful—I have a really long password and suck at typing, so being able to mash the fingerprint sensor is really helpful.

But yes, it is very frustrating that every time there's a system update you have to redo it.

Re: Use Touch ID for Sudo on Mac

#19

Post by aequitas » Mon, Mar 01, 2021, 1:49 PM UTC

fluder wrote: post #4

And with every macOS update you should do it again and again. Just another not useful tip.

Or just use Puppet to manage your macOS installation which makes things a lot easier ;)

Re: Use Touch ID for Sudo on Mac

#20

Post by gumby » Mon, Mar 01, 2021, 1:49 PM UTC

pplante wrote: post #7

rvz wrote: post #2

Very handy. But you can use your Apple Watch for sudo which is even better: [0] [0] https://github.com/insidegui/pam-watchid

I agree using your watch is cool. However I think you lose out on the security aspect, an important element that a fingerprint provides all on the same device.

I think it’s not that bad, security wise. Your watch unlocks as soon as it leaves your wrist, and the unlock handshake uses the BT hardware to figure out how close your watch is.

I think this isn’t a great UX for other reasons I posted on this discussion. But the security is acceptable to me.