3 ms·

You still have to provide a password. Fingerprints are not passwords. They are usernames.

• andr0x 6y ago
  huh? fingerprints are not 'usernames' (you don't just provide a 'username' for an applepay authorization for example). and yes, adding this in you do _not_ have to type out your sudo password and can grant permissions using only touch id.
• lenocinor 6y ago
  Technically you are correct and I used to complain about this myself for years. But it seems like at least for consumers they’re often content to have authentication equal authorization so I feel like mostly this battle has been lost in the consumer space.
• samatman 6y ago
  This is correct only in the instance that a biometric is stored on the host. In TouchID, the biometric is stored only in the secure enclave, and is used to generate a private key signature, which serves as the password. Additionally, it's always possible to reset TouchID to an unauthenticated state, where it will refuse a fingerprint read until the password is typed in. There's no sense cargo-culting this bit of conventional wisdom without understanding where it comes from, and what sort of attacks it is meant to prevent.