You also need to remove the line below, otherwise, you'll be asked to authenticate twice using both methods: auth sufficient pam_smartcard.so
Only if you currently have a smartcard configured. If not, you won't be.
Use Touch ID for Sudo on Mac
141–150 of 221 posts
Re: Use Touch ID for Sudo on Mac
#142Does anybody know if there's a solution for keychain password copy too? I have a very complicated vpn password that I change often (so I don't remember it), but each day, when connecting to the vpn, I have to open keychain and type my user password to get the vpn password. I couldn't find a way to use touch id for that.
Out of curiousity why do you change a complex password regularly? Is this something your evilCorp policy forces you to do, or something you do out of habit because of something you read on the internet, or even rote habit from something picked up at previous evilCorp policies?
The evilItDepartmentPolicy forces me, but I would do it by my own will (less often) too, if not forced. I have acces on a lot of sensitive places and I don’t want to risk it.
Re: Use Touch ID for Sudo on Mac
#143Earlier quoted context omitted.
Why cant Apple use their TimeMachine tech to take a snapshot of the prefs on the existing, then do their image based update, then have it automatically apply the prefs from the timemachine mod-integration? The richest company in the world can't think different?
What if one file was written by a malicious program?
You already have to reboot into the Recovery environment and disable both System Integrity Protection (with csrutil) and OS root-volume signing (with bputil) in order to even (persistently) modify any of the files in /System now.
Malware can't do that, because there's no way for any executable that runs in the regular OS—and isn't signed by Apple—to get anything to automatically happen over in the Recovery OS.
(That's not to say you can't have persistent malware in macOS; just that it can't persist itself into the OS boot volume. It has to persist into the user volume—which is great, because that means the OS can, on boot, mount the user volume noexec and scan it for malware while running in a known-good base state. That's even without needing to boot into the recovery OS.)
So, other than OS updates, basically the only reason these files get modified is when people modify them manually. And the only people doing that are 1. people developing kernel extensions (or their friends, the Hackintosh community); and 2. enterprises burning low-level configuration changes into OS images for image-based deployment.
And both of those cases involve modifying things that are effectively "underneath the OS API abstraction", and therefore don't have the same ABI guarantees that the OS APIs themselves do. Thus the whitelist.
Re: Use Touch ID for Sudo on Mac
#144Earlier quoted context omitted.
I suspect the main reason is that the face-id camera module is too thick and they'd need to increase the thickness of the display casing. If there's on thing the Mac designers will never allow it's a thicker laptop.
Based on iFixit's iPhone 12 teardown and thus the most recent version of the module, I think they might be able to get it into the screen without much compromise. An important consideration here is that it's not just about the Face ID bit, it's about the better camera bit. While it was important even earlier, this past year has made videoconferencing and other remote work rocket up in priorities, and Macs suck pretty…
The current thickness of the MacBook lid (my 16") is 3.5mm. Given that you need glass and metal in that 3.5mm as well as the faceID module, you're talking about significantly changing the dimensions of the MacBooks to do this with today's faceID module.
I look forward to the day they do get it fit in there though (hoping that the Silicon redesign allows for it)!
Re: Use Touch ID for Sudo on Mac
#145Using biometrics instead of a secret-based authentication is always a bad idea. Secrets can be changed easily when they get compromissed, your figerprints/iris/whatever cannot. https://www.csoonline.com/article/3330695/6-reasons-biometri...
> is always a bad idea.
Making sweeping generalizations about something as complex as information security is always a bad idea.
Re: Use Touch ID for Sudo on Mac
#146Earlier quoted context omitted.
Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the sa…
Why cant Apple use their TimeMachine tech to take a snapshot of the prefs on the existing, then do their image based update, then have it automatically apply the prefs from the timemachine mod-integration? The richest company in the world can't think different?
Just my opinion here, but I feel like Apple again doesn't really care about power users. 98% of their users won't be making any customizations like this, so they don't care to spend money working on those "edge cases." Their primary mission is to sell devices and apps to average people who aren't tech geeks. And I don't think Apple cares about general purpose computing. I see MacOS getting closer to iOS with every update, and I'm betting that at some point we'll lose filesystem access and sudo access.
Re: Use Touch ID for Sudo on Mac
#147Very handy. But you can use your Apple Watch for sudo which is even better: [0] [0] https://github.com/insidegui/pam-watchid
I agree using your watch is cool. However I think you lose out on the security aspect, an important element that a fingerprint provides all on the same device.
>I think you lose out on the security aspect
Can you clarify what you mean by this? I love the idea of unlocking and running admin stuff with my watch but kinda gave up on the idea because I assumed there would be security implications. After thinking about it a little more, though, I haven't really been able to come up with anything that didn't already require physical access to my machine and some way to authenticate (password or fingerprint). Since you have to authenticate your device to authenticate the watch and it un-authenticates any time it's removed, it seems like you don't lose anything security-wise.
Re: Use Touch ID for Sudo on Mac
#148Earlier quoted context omitted.
shift Z Z is faster.
Debatable and depends on length of time shortcut has been in use. I can type :wq like a madman. My finger can slide straight from w to q, whereas with double-z, I have to pick my finger up and put it back down. So much movement! What next, you want me to run a marathon?
You are all wrong. The Emacs shortcuts are far superior. /s
Re: Use Touch ID for Sudo on Mac
#149Touch ID is awesome, but I semi-regularly use the APFS snapshot rollback feature and it erases my finger prints. Does anyone know why this happens? I was very happy when I found out APFS is CoW but it kind of sucks that restoring an old snapshot apparently erases the secure enclave in my M1 chip.
More than likely because that's a security risk. If it didn't do this, an attacker could likely roll back your machine to before you had Touch ID set up and then roll it forward again to access your data, now without a Touch ID restriction.
Re: Use Touch ID for Sudo on Mac
#150Earlier quoted context omitted.
Less likely to accidentally fool you into tapping the finger sensor vs fool you into showing your face to the camera
Not sure how "fooling" comes into play. Only trusted applications can request to use Touch ID/Face ID in the first place. It's not like there's a way for a random application to just say "Scan your face and let me take over your machine"
One point is that the touch prompt is “out of band”: it shows up in its own window. Some other app could open that request while you’re looking elsewhere then yiu type sudo, look up, see it (without focus), so click it and then put your finger on the sensor. When your sudo remains blocked you see the other, click I, and proceed under the assumption it was a glitch.
Sounds complicated but is actually quite plausible. And worse under face I’d as it would be more seamless. iOS is different as the user interface is largely single task (slightly less under ipad) and background tasks that need face ID need a notification and explicit selection to get it