Use Touch ID for Sudo on Mac • Hacker News Board

Re: Use Touch ID for Sudo on Mac

#71

Post by gumby » Mon, Mar 01, 2021, 2:50 PM UTC

xoa wrote: post #27

gumby wrote: post #13

As the author says, “Since you expect to be be typing in a command line, moving your finger to touch the key is probably not very efficient.” I was excited to set this up when the first fingerprint sensor macs came out. Within a couple of days I’d switched it off. It is quite inconvenient and especially bad if you use an external keyboard.

It still strikes me as weird that Apple went with Touch ID vs Face ID on the Mac. Computer form factors in general, and particularly notebooks and AIOs, should be perfect for Face ID: the user is always at a good distance, in the right position, looking at it, and as you say will frequently have their hands otherwise occupied actually controlling the system. For that matter a Face ID+iPhone-quality camera thing for M…

> It still strikes me as weird that Apple went with Touch ID vs Face ID on the Mac

BTW the face system is so automatic on the phone that I don't think I'd want it for much beyond login. The flow-breaking reminders when installing apps and the explicit requirement of typing sudo are good ways to require deliberate intent for dependent risks. Login, App Store purchases and the like would be OK by me if controlled by face.

All that being said: the Mac camera remains astonishingly terrible (see a recent HN front pager about how bad webcams are in general). Not just low resolution but poor white balance etc. I am not sure it's been upgraded in the last decade.

There is much speculation as to why (no room in the lid, which is plausible); I feel like for some reason this is an issue on which they simply don't care for some reason as they make a lot of fuss about the changes in speaker and microphone. Perhaps it simply is good enough, based on the innumerable Zoom calls I've been on.

Face ID needs more than a better camera, it also needs an IR channel. I do expect that when they finally do get around to upgrading the camera system they will jump ahead to something like the iphone front facing system.

Re: Use Touch ID for Sudo on Mac

#72

Post by asidiali » Mon, Mar 01, 2021, 2:52 PM UTC

exikyut wrote: post #51

asidiali wrote: post #39

Earlier quoted context omitted.

Debatable and depends on length of time shortcut has been in use. I can type :wq like a madman. My finger can slide straight from w to q, whereas with double-z, I have to pick my finger up and put it back down. So much movement! What next, you want me to run a marathon?

I guess it's a learned dexterity thing. :wq = ZZ = As someone with mildly poor dexterity (and I don't touch-type with all my fingers, I mostly use my index fingers), the second approach looks somewhat more interesting to test.

Interesting, I will add flexibility too, or maybe hand size. I find it slightly uncomfortable to hit shift and Z simultaneously with solely my left hand, so I hit shift with my right and z with my left. Alternatively, I will simultaneously hit shift + colon with my right, and then do the wq slide as mentioned above. Nice that all hands can be accommodated :)

Re: Use Touch ID for Sudo on Mac

#73

Post by dustinmoris » Mon, Mar 01, 2021, 2:52 PM UTC

egberts wrote: post #53

no, No, no, noooo, please, God. Nooooooooooo. Biometric are non-revocable.

Yes, it's terrible. Every time I walk through passport control and the person validates my identity through a biometric check by looking at my face and looking at my passport I cringe and tell them that it's terrible and they should instead let me type a password.

Re: Use Touch ID for Sudo on Mac

#74

Post by emidln » Mon, Mar 01, 2021, 2:56 PM UTC

dustinmoris wrote: post #69

rmathot wrote: post #65

Using biometrics instead of a secret-based authentication is always a bad idea. Secrets can be changed easily when they get compromissed, your figerprints/iris/whatever cannot. https://www.csoonline.com/article/3330695/6-reasons-biometri...

How often has your mother given money to someone else who pretended to be you? Because parents identify their children through biometric authentication. They look at you and can in a matter of split seconds verify that you are actually you. Biometric authentication is the oldest and most sophisticated form of authentication. I can enter my work place and nobody asks me to type in a password at the door because the st…

Your mother doesn't view you through a 0.3MP camera in a dimly lit room with no flash when deciding if the person in front of her is her child.

Further, if I take a high resolution photo of you, and then go to your mom and ask for money by presenting her the picture, she won't accept that picture as proof that I am you (although she may suspect I'm blackmailing or otherwise threatening you). This, moreso than qualms about the resolution/quality of the sensor is the GP's point. If the sensors are accurate, that specific set of bits that is translated as your fingerprint will not change. If someone knows those bits, it's extremely likely they can convince the sensor they are you. From our example, once I have your picture, I can tell your mother I'm you--and she'll believe me!

Re: Use Touch ID for Sudo on Mac

#75

Post by bitlevel » Mon, Mar 01, 2021, 2:58 PM UTC

angulardragon03 wrote: post #49

philote wrote: post #47

Earlier quoted context omitted.

It seems in Big Sur the file you need to edit is not writable. So you need to make it writable first, edit it, and then change permissions back to read-only.

This doesn't seem to be strictly true - the two-line solution worked exactly as expected for me on 11.2.1. I used nano instead of vi (personal preference), but it worked nonetheless.

Maybe that's the difference. I was using vi, and not nano.

Have confirmed that using 'sudo nano /etc/pam.d/sudo' works fine.

No need for the verbosity when nano works I guess. :S

Re: Use Touch ID for Sudo on Mac

#76

Post by dustinmoris » Mon, Mar 01, 2021, 2:58 PM UTC

emidln wrote: post #74

dustinmoris wrote: post #69

Earlier quoted context omitted.

How often has your mother given money to someone else who pretended to be you? Because parents identify their children through biometric authentication. They look at you and can in a matter of split seconds verify that you are actually you. Biometric authentication is the oldest and most sophisticated form of authentication. I can enter my work place and nobody asks me to type in a password at the door because the st…

Your mother doesn't view you through a 0.3MP camera in a dimly lit room with no flash when deciding if the person in front of her is her child. Further, if I take a high resolution photo of you, and then go to your mom and ask for money by presenting her the picture, she won't accept that picture as proof that I am you (although she may suspect I'm blackmailing or otherwise threatening you). This, moreso than qualms…

So your qualm is low quality biometric scanning, not biometrics itself? So we agree that biometrics are the most secure form of authentication and we are only debating on the quality of the technology, which we know is getting better day by day, yeah?

Re: Use Touch ID for Sudo on Mac

#77

Post by egberts » Mon, Mar 01, 2021, 2:59 PM UTC

dustinmoris wrote: post #73

egberts wrote: post #53

no, No, no, noooo, please, God. Nooooooooooo. Biometric are non-revocable.

Yes, it's terrible. Every time I walk through passport control and the person validates my identity through a biometric check by looking at my face and looking at my passport I cringe and tell them that it's terrible and they should instead let me type a password.

for things that you own, not for government-owned biometric.

Re: Use Touch ID for Sudo on Mac

#78

Post by nneonneo » Mon, Mar 01, 2021, 3:02 PM UTC

I just have a setuid root sudo binary (compiled from sudo-touchid: https://github.com/mattrajca/sudo-touchid) in my home folder ~/bin. This has worked a treat across OS updates, without hacking PAM stuff. It’s extremely convenient and has probably saved me cumulative hours in typing out my long password :)

Re: Use Touch ID for Sudo on Mac

#79

Post by nxpnsv » Mon, Mar 01, 2021, 3:03 PM UTC

exikyut wrote: post #51

asidiali wrote: post #39

Earlier quoted context omitted.

Debatable and depends on length of time shortcut has been in use. I can type :wq like a madman. My finger can slide straight from w to q, whereas with double-z, I have to pick my finger up and put it back down. So much movement! What next, you want me to run a marathon?

I guess it's a learned dexterity thing. :wq = ZZ = As someone with mildly poor dexterity (and I don't touch-type with all my fingers, I mostly use my index fingers), the second approach looks somewhat more interesting to test.

This is going to save you seconds, every year!

Re: Use Touch ID for Sudo on Mac

#80

Post by jrockway » Mon, Mar 01, 2021, 3:04 PM UTC

rmathot wrote: post #65

Using biometrics instead of a secret-based authentication is always a bad idea. Secrets can be changed easily when they get compromissed, your figerprints/iris/whatever cannot. https://www.csoonline.com/article/3330695/6-reasons-biometri...

On the other hand, you can't type your fingerprint into a random link that you receive in your email.

I think modern devices that use biometrics to unlock a secret key are different from the old-school case of biometric authentication. If someone is storing a picture of your fingerprint, then of course they can replay that to impersonate you. But that's not what TouchID is doing -- it's just a chip that will only give up the private key if it detects your fingerprint. You have to have physical access to that chip, and a finger analog that will fool the chip into giving up the secret key, and then you can use that key to compromise things. But if you detect that, you just revoke the key, get a new device, and are good to go.

I don't have a great analysis for sudo. You want root on MacOS to do something like install a long-term compromise. Your regular user account already has your GMail session cookie and bank information, so sudo isn't really good for anything else; if you leave your unlocked laptop around somewhere, your Internet life is over. But if someone physically steals your finger so they can gain access to sudo and install a keylogger or something, you already know you're compromised -- your laptop and finger are gone, so you know something's up, defeating the purpose of a long-term compromise.

This attack can't be done remotely; if someone sshs to your laptop and wants to sudo, they can't just take a picture of your fingerprint and upload it... they have to physically touch the sensor on your laptop.

Overall, I think biometrics like TouchID / FaceID / U2F / WebAuthn are strictly better than passwords. They are super convenient. They can be revoked. They can't be phished. That's a huge win over passwords.