Show HN: A fork of sudo with Touch ID support • Hacker News Board

Re: Show HN: A fork of sudo with Touch ID support

#91

Post by tomphoolery » Mon, Oct 31, 2016, 3:32 PM UTC

pritambaral wrote: post #3

Similar: On Linux, doing something like this doesn't require patched sudo. sudo uses the OS provided auth framework (PAM), which is pluggable (the 'P' in 'PAM' stands for 'Pluggable'); and fprintd provides a pam plugin. The `LocalAuthentication` framework this project mentions sounds like an OS X equivalent of PAM — an OS level account auth framework. I wonder why/if the `sudo` on OS X doesn't use it.

From the README...

"While not useful in practice, you can use this to verify that the LocalAuthentication code does in fact work."

Almost seems like the author just wrote it to test the LocalAuthentication framework in the real world.

Re: Show HN: A fork of sudo with Touch ID support

#92

Post by sjtgraham » Mon, Oct 31, 2016, 3:44 PM UTC

I have a feeling this is EXTREMELY DANGEROUS to have on your Mac. Using DYLD_INSERT_LIBRARIES and attacker could inject code that swizzles -[LAContext evaluatePolicy: localizedReason:reply] to always invoke the callback block with success set to YES. e.g.

DYLD_FORCE_FLAT_NAMESPACE=1 DYLD_INSERT_LIBRARIES=evil.dylib my_sudo rekt

This won't work on SIP protected binaries (n.b. system binaries), but might still work on other binaries while SIP is enabled. It's mostly moot however as many developers have SIP disabled.

Re: Show HN: A fork of sudo with Touch ID support

#93

Post by badminton1 » Mon, Oct 31, 2016, 3:47 PM UTC

Be mindful that it is not hard to lift fingerprints to trick that authentication method.

Most specially, in an office environment it can be done from a mouse, a keyboard, a glass of water, etc.

There are some videos in YouTube showing how it can be done.

Re: Show HN: A fork of sudo with Touch ID support

#94

Post by badminton1 » Mon, Oct 31, 2016, 3:49 PM UTC

TekMol wrote: post #14

I never understood the obsession with sudo. Why not just be root in the first place?

Because you don't want every process to have control over the file system and other processes.

This limits the impact of a misconfigured service, a compromised service, or just a plain malicious service... or users of such services.

Then, it doesn't necessarily have to be malicious, you can also harm your system by accident. I have done it many times.

Re: Show HN: A fork of sudo with Touch ID support

#95

Post by arnarbi » Mon, Oct 31, 2016, 4:13 PM UTC

rrmm wrote: post #25

arnarbi wrote: post #21

Earlier quoted context omitted.

It's a "something you are" authentication factor, since it is presumed that the cost of faking a fingerprint is too high to be worth it in those cases.

I guess I like the trade-offs of something-you-have/something-you-know even if the cost of faking them is actually lower. I am probably in a minority.

When done correctly, fingerprints are both something you are and something you have: The fingerprint data should reside in and work only to activate an HSM that then proves possession of an attested key pair. That way the HSM (and the device it sits in) is your something to have.

Re: Show HN: A fork of sudo with Touch ID support

#96

Post by jlarocco » Mon, Oct 31, 2016, 4:14 PM UTC

matt4077 wrote: post #79

This here is what gets me salivating: Using the toolbar as a context-sensitive test runner/controler: https://pbs.twimg.com/media/CwC8SNvW8AQgeWN.png:large

Yeah, but you're ignoring the functionality loss from not having the function keys. You may not use them, but many people do.

For example, in Emacs (and I'm assuming most IDEs) I can map a function key to run my tests and have a status bar entry saying how many passed or failed. It's the exact functionality in your screenshot, no touch bar required.

At best the touch bar is a nice gimmick, and it's not adding anything you can't already do, and the trade off is the function keys. They could have just as easily left the function keys alone and added the touch bar above.

Re: Show HN: A fork of sudo with Touch ID support

#97

Post by arnarbi » Mon, Oct 31, 2016, 4:15 PM UTC

zwp wrote: post #49

arnarbi wrote: post #21

Earlier quoted context omitted.

It's a "something you are" authentication factor, since it is presumed that the cost of faking a fingerprint is too high to be worth it in those cases.

https://www.schneier.com/crypto-gram/archives/2002/0515.html... "He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen. And he defeated eleven different commercial fingerprint readers, with both optical and capacitive sensors, and some with "live finger detection" features." That article's a little old now and the tech may well have improved since but I wouldn'…

My point is that this is still more expensive than harvesting knowledge factors with phishing and stealing dbs where people use the same factors.

Re: Show HN: A fork of sudo with Touch ID support

#98

Post by arnarbi » Mon, Oct 31, 2016, 4:21 PM UTC

rrmm wrote: post #83

a_c_s wrote: post #80

Earlier quoted context omitted.

Yeah, I'm not an international spy: even if it is 'easy', nobody is going to spend a few hours faking my fingerprint just to get into my phone or my laptop. And if they are so motivated, then there's a much bigger problem at hand. There are plenty of people still using 4 digit passcode (especially simple ones like 0000 or 1234) which is easy to 'steal' by watching somebody unlock their phone before pickpocketing them…

The bigger issue in my mind is revocation and separation of identities. I only have one set of fingerprints. What's more, I may not want my biological identity connected to online identities. It would be like having to give every website your SSN/National ID to identify yourself rather than merely a unique ID. You are giving out a huge amount of info with your fingerprint. Now some of the above issues aren't specific…

As you point out, there's a right way to do fingerprints, which Apple did. Only the key pair stored in the secure enclave is tied to your online identity.

There is a missing link in the trust chain though, which is attestation of that secure enclave (how do we know it is a legitimate and uncompromised one?) However, privacy preserving attestation mechanisms such as DAA [1] require somewhat expensive crypto.

[1] https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation

Re: Show HN: A fork of sudo with Touch ID support

#99

Post by stephenr » Mon, Oct 31, 2016, 4:21 PM UTC

jlarocco wrote: post #96

matt4077 wrote: post #79

This here is what gets me salivating: Using the toolbar as a context-sensitive test runner/controler: https://pbs.twimg.com/media/CwC8SNvW8AQgeWN.png:large

Yeah, but you're ignoring the functionality loss from not having the function keys. You may not use them, but many people do. For example, in Emacs (and I'm assuming most IDEs) I can map a function key to run my tests and have a status bar entry saying how many passed or failed. It's the exact functionality in your screenshot, no touch bar required. At best the touch bar is a nice gimmick, and it's not adding anythin…

Remind me again how function keys can produce full colour multitouch interfaces, such as video/image scrubbers, colour pickers, etc.

The standard "function keys can do anything" response is getting old.

Re: Show HN: A fork of sudo with Touch ID support

#100

Post by pasyormie » Mon, Oct 31, 2016, 4:24 PM UTC

sjtgraham wrote: post #92

I have a feeling this is EXTREMELY DANGEROUS to have on your Mac. Using DYLD_INSERT_LIBRARIES and attacker could inject code that swizzles -[LAContext evaluatePolicy: localizedReason:reply] to always invoke the callback block with success set to YES. e.g. DYLD_FORCE_FLAT_NAMESPACE=1 DYLD_INSERT_LIBRARIES=evil.dylib my_sudo rekt This won't work on SIP protected binaries (n.b. system binaries), but might still work on…

This would not work. setuid binaries do not respect these flags, for obvious reasons. But if you're at the point where you can inject environment vars into a devs workstation, it's probably too late for that dev.