3 ms·

Not sure how "fooling" comes into play. Only trusted applications can request to use Touch ID/Face ID in the first place. It's not like there's a way for a rand

• nikanj 6y ago
  Exploits do happen, and to me it sounds reasonable that a web page gets local unprivileged code execution -> sudo (which is a trusted application) -> my face was already in front of the camera -> root. I guess this could be circumvented with a "click OK if you agree to get face ID" dialog or similar. Anyway, you need to figure out a way to deal with the "key" always being in the lock if you're using face id on a laptop.
• gumby 6y ago
  One point is that the touch prompt is “out of band”: it shows up in its own window. Some other app could open that request while you’re looking elsewhere then yiu type sudo, look up, see it (without focus), so click it and then put your finger on the sensor. When your sudo remains blocked you see the other, click I, and proceed under the assumption it was a glitch. Sounds complicated but is actually quite plausible. And worse under face I’d as it would be more seamless. iOS is different as the user interface is largely single task (slightly less under ipad) and background tasks that need face ID need a notification and explicit selection to get it