Exploits do happen, and to me it sounds reasonable that a web page gets local unprivileged code execution -> sudo (which is a trusted application) -> my face wa

Exploits do happen, and to me it sounds reasonable that a web page gets local unprivileged code execution -> sudo (which is a trusted application) -> my face was already in front of the camera -> root. I guess this could be circumvented with a "click OK if you agree to get face ID" dialog or similar. Anyway, you need to figure out a way to deal with the "key" always being in the lock if you're using face id on a laptop.