Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use Touch ID for Sudo on Mac

davidwalsh.name

Post reply on HN
Print view View original

121–130 of 221 posts

Re: Use Touch ID for Sudo on Mac

#121

Post by hannibalhorn »

zuppy wrote: post #70

Does anybody know if there's a solution for keychain password copy too? I have a very complicated vpn password that I change often (so I don't remember it), but each day, when connecting to the vpn, I have to open keychain and type my user password to get the vpn password. I couldn't find a way to use touch id for that.

Kinda close - I use Hammerspoon to setup a hotkey that runs security(1) via popen to retrieve and paste passwords into some apps.

    /usr/bin/security find-internet-password -wgs mydomain.com
It requires the keychain to be unlocked, which can be handled with touch ID, and you can have it confirm with a "are you sure" dialog box every time.

If you really wanted to be prompted for a fingerprint basically every time, you could probably use a separate keychain that locks after 1 minute of inactivity.

Re: Use Touch ID for Sudo on Mac

#122

Post by jeffbee »

derefr wrote: post #106
jeffbee wrote: post #98

Earlier quoted context omitted.

This is a very macOS problem. Why does it reset every preference on updates? The one that kills me is wake-on-lan, that gets turned back on regardless. Hate!

Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the sa…

The thing that doesn't make sense here is that macOS discards randomly your settings, but it is also the only OS I use that regularly gets in a fucked up state where settings have to be nuked. I mean, here we are in year 37 of the mac and people are still zapping their PRAMs. The only improvement is you don't have to physically pull out the battery.

Re: Use Touch ID for Sudo on Mac

#123

Post by azinman2 »

Demigod33 wrote: post #115
samstave wrote: post #111

Earlier quoted context omitted.

Why cant Apple use their TimeMachine tech to take a snapshot of the prefs on the existing, then do their image based update, then have it automatically apply the prefs from the timemachine mod-integration? The richest company in the world can't think different?

What if one file was written by a malicious program?

Ya I think saying it’s not for security is making a lot of assumptions.

Re: Use Touch ID for Sudo on Mac

#124

Post by curt15 »

derefr wrote: post #106
jeffbee wrote: post #98

Earlier quoted context omitted.

This is a very macOS problem. Why does it reset every preference on updates? The one that kills me is wake-on-lan, that gets turned back on regardless. Hate!

Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the sa…

>Unlike ChromeOS/CoreOS, after the first-round SHA verification of the volume, macOS will then patch the new OS-base-image volume with certain files from your current OS-base-image volume, if 1. they’re distinct from the ones it expected to be there, and 2. they appear on a whitelist of known-safe files.

Red Hat CoreOS (and other Linux systems managed with OSTree, such as Fedora Silverblue) now do something similar by merging the current /etc directory with the "upstream" version.

Re: Use Touch ID for Sudo on Mac

#125

Post by ethanpil »

ctur wrote: post #67

Every update requires you to redo this. It's so repetitive that I keep a copy of what I want `/etc/sudo` to look like in my homedir and, whenever I get the prompt for a sudo attempt, I instead sudo to cp the file. Then I go on my way with what I was originally intending.has recently sudo'd. Rote but effective.

Why not run a script on boot that does the update? Does it need to be in the .bashrc?

Re: Use Touch ID for Sudo on Mac

#126

Post by nikanj »

jaywalk wrote: post #45
nikanj wrote: post #35

Earlier quoted context omitted.

Less likely to accidentally fool you into tapping the finger sensor vs fool you into showing your face to the camera

Not sure how "fooling" comes into play. Only trusted applications can request to use Touch ID/Face ID in the first place. It's not like there's a way for a random application to just say "Scan your face and let me take over your machine"

Exploits do happen, and to me it sounds reasonable that a web page gets local unprivileged code execution -> sudo (which is a trusted application) -> my face was already in front of the camera -> root.

I guess this could be circumvented with a "click OK if you agree to get face ID" dialog or similar. Anyway, you need to figure out a way to deal with the "key" always being in the lock if you're using face id on a laptop.

Re: Use Touch ID for Sudo on Mac

#129

Post by lispm »

jeffbee wrote: post #122
derefr wrote: post #106

Earlier quoted context omitted.

Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the sa…

The thing that doesn't make sense here is that macOS discards randomly your settings, but it is also the only OS I use that regularly gets in a fucked up state where settings have to be nuked. I mean, here we are in year 37 of the mac and people are still zapping their PRAMs. The only improvement is you don't have to physically pull out the battery.

In year 37 you can't manually zap the 'PRAM' on Apple Silicon Macs.
Post reply on HN