Live data from Hacker News

Use Touch ID for Sudo on Mac

davidwalsh.name

191–200 of 221 posts

Re: Use Touch ID for Sudo on Mac

#191
post #179

This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal computers, but what about companies that log in with yubikeys or smart cards? Do they have to reconfigure after every update too?

Did this work on iTerm?

Yes

Re: Use Touch ID for Sudo on Mac

#192
post #184

Earlier quoted context omitted.

This is absolutely terrible advice!

Can you explain why? I'm genuinely curious in case I've missed something!

I'm guessing they meant because malware can now run commands as root without prompting for a password, however I'd argue that if you have malware running as your user in the first place then that will likely be more damaging to you than it getting root and modifying your system, as it will be able to access browser session cookies, personal documents, etc.

Personally I don't have passwordless sudo but I'm also curious as to what the attack vector might be here if you were to enable it.

Re: Use Touch ID for Sudo on Mac

#193

You still have to provide a password. Fingerprints are not passwords. They are usernames.

Technically you are correct and I used to complain about this myself for years. But it seems like at least for consumers they’re often content to have authentication equal authorization so I feel like mostly this battle has been lost in the consumer space.

Re: Use Touch ID for Sudo on Mac

#194

You still have to provide a password. Fingerprints are not passwords. They are usernames.

This is correct only in the instance that a biometric is stored on the host.

In TouchID, the biometric is stored only in the secure enclave, and is used to generate a private key signature, which serves as the password.

Additionally, it's always possible to reset TouchID to an unauthenticated state, where it will refuse a fingerprint read until the password is typed in.

There's no sense cargo-culting this bit of conventional wisdom without understanding where it comes from, and what sort of attacks it is meant to prevent.

Re: Use Touch ID for Sudo on Mac

#195
post #167

Earlier quoted context omitted.

Have you ever been FORCED to upgrade/update against your will for a new release whereby you say NO NO NO - then you make the mistake of falling asleep with your phone plugged into the charger to wake to a forced update to your device? Yeah - fuck apple - and fuck Jonny Ive - they claim to be the masers of all aspects of designs, but really they're they masters of /r/assholedesign Their hardware is in the top 70th % -…

That’s a lot of anger and words over something that, in the grand scheme of things, is so utterly unimportant and almost contemptuously irrelevant. Things are always a trade-off. There are big positives to keeping the ecosystem on a consistent, new and secure version of iOS. Similar positives apply to MacOS.

His macbook catching on fire is pretty darn important

Re: Use Touch ID for Sudo on Mac

#196
post #29

Earlier quoted context omitted.

I want a mouse with Touch ID in the button. Or on the side.

It would be cool if they built it into the touchpad in a future generation. I'm guessing once they can figure out fingerprint through the glass on iPhone they'll do it in the touchpad, too.

I've always wondered why they can't just build a fingerprint sensor into a capacitive touchscreen. After all, a fingerprint sensor IS just a really high density capacitive touch sensor right? Or is that not right?

Google gives me no answers and I assumed it was not fundamentally impossible, just that it was two separate companies with two separate production lines making touchscreens and fingerprint sensors so it was hard in practice due to the realities of supply chains.

Many existing fingerprint sensors, like TouchID, were glass, and I wonder why they can't just make it bigger and put an OLED under that glass (even if it was only dense enough for fingerprints at one spot).

Yet here we are, 4 years after the downgrade too FaceID, and still not a single phone in existence with a capacitive fingerprint sensor in the screen.

Am I wrong about the technology or what?

Re: Use Touch ID for Sudo on Mac

#197
post #184

Earlier quoted context omitted.

This is absolutely terrible advice!

Can you explain why? I'm genuinely curious in case I've missed something!

If a virus/malware was running on your system as your user, it now has root access to your machine by doing nothing more than accessing the shell.

Re: Use Touch ID for Sudo on Mac

#199

Earlier quoted context omitted.

The thing that doesn't make sense here is that macOS discards randomly your settings, but it is also the only OS I use that regularly gets in a fucked up state where settings have to be nuked. I mean, here we are in year 37 of the mac and people are still zapping their PRAMs. The only improvement is you don't have to physically pull out the battery.

Purely anecdotal, of course, but: - If macOS is the only OS that you use regularly that gets in a fucked up state, then either you're not using Windows or it's gotten a lot better in the last few years. :) (I mean, it undeniably has gotten better, but I have Windows-using acquaintances who still kvetch about this issue pretty regularly.) - I've been using Macs since 1999 and I don't think I've had to reset the PRAM t…

Windows definitely allows you to shoot yourself in the foot, but nowadays those settings are hidden away by non-flashy applications, which has now become synonymous with "advanced user shit I probably shouldn't be touching".

Though the difference is, if something gets royally screwed up on MacOS, at least there's a sane enough way to reset it. On Windows, it often entails a reformat.

And let's not get started on the Windows Updates. They too have the whole "reset settings" problem (e.g. "don't f&!king restart my computer randomly", which gets reset every somewhat major update).

Post reply on HN