51–60 of 120 posts
This is great. I see many times "security advice" against biometrics replacing password unlock, but most of the time I am more worried about getting recorded by somebody/something while typing a password in the open than anything else. This makes it better for those other cases.
Regrettably, that's not often offered as a feature, even when the infrastructure is already there.
This is great. I see many times "security advice" against biometrics replacing password unlock, but most of the time I am more worried about getting recorded by somebody/something while typing a password in the open than anything else. This makes it better for those other cases.
At that point what you need is true multi-factor. For example, both fingerprint and per-device PIN. Regrettably, that's not often offered as a feature, even when the infrastructure is already there.
This is great. I see many times "security advice" against biometrics replacing password unlock, but most of the time I am more worried about getting recorded by somebody/something while typing a password in the open than anything else. This makes it better for those other cases.
- touchid and biometric configuration profiles (standard, paranoid, extra paranoid)
- versioning for icloud backup
The simple fact is that there is no one-sized-fits-all use case for this.
Biometrics are great for the average user! They reduce shoulder surfing and increase security.
But for some users, you might want two factor for biometrics (such as an apple watch), or short windows before password entry is forced. You might want both biometrics AND password entry required. You might want to enable biometrics only when two factor is enabled.
Look, I'm not saying that what I've said is the ideal setup, by the way. Just that there is a lot of room for improvement versus the status quo.
Earlier quoted context omitted.
At that point what you need is true multi-factor. For example, both fingerprint and per-device PIN. Regrettably, that's not often offered as a feature, even when the infrastructure is already there.
Notably macOS cannot do this
macOS can in fact be configured to use a third party idp, including interactive elements, on loginwindow.
So, you could build your own through the ExtensibleSingleSignOn and Extensible Enterprise SSO macOS plugin API. You would do touchid, and then have it pop your own custom window/app, providing a prompt through that API, except it's just a hardcoded value (or some shit idk)
So yes, macOS can in fact do that. Just not out of the box. I strongly believe that it is a glaring omission, or at least something they should gate through lockdown mode. idk!
Great work, congrats!
If someone can force you to use touch id they can probably also force you to enter your password. (If you’re about to comment about fingerprints on transparency film and balloons filled with warm water then yes good point)
Of course, I imagine the majority of people would yield their password if you simply threatened to detain them long enough to make them miss their flight.
Nice to see something like this on the Mac side.
The iOS equivalent is to hold the side + volume button until the power slider shows up. Cancel out of it and the next unlock will require your passcode. Pressing the side button 5x triggers Emergency SOS which does the same thing. Been there forever but barely anyone knows about it. Nice to see something like this on the Mac side.