10 ms·
WSL Hello Sudo: Face Recognition of Windows Hello on Windows Subsystem for Linux
- throwoutttt 6y agoWish I had this much time to waste
- Orochikaku 6y agoIt’s really discouraging to see such a negative sentiment to the the namesake of this website here. Hacking around at systems you’re interested in is hardly a waste of time, it’s through projects driven by self interest that we learn the most imo.
- alexdumitru 6y agoThis looks great. I hate Linux desktop and Windows server, so WSL has been a blessing for me.
- 29athrowaway 6y agoI hate the Windows desktop (and server). Right now I am using XFCE. Much faster than Windows, lower memory footprint and I got it to look similar to macOS to some extent. Using Windows compared to using XFCE is like pulling a stubborn donkey. No, I don't want to update, I don't want a voice assistant, I don't want absurd UIs, I don't want telemetry, I just want a goddamn menu and desktop icons.
- zeusk 6y agoWhat do you mean I have to use iwconfig to fix my network? No, I just want to connect to a network. I don't want to write scripts for every device to suspend and resume.
- 29athrowaway 6y agoYou don't need iwconfig to fix your network. You can just use the network settings UI. Next.
- kiwijamo 6y agoIt's been years since that was necessary. All major distros do this sort of thing automatically now with GUI configuration tools as a first class option. Even on bare bones distros like Debian.
- petepete 6y agoSetting up my laptop with Fedora is a more straightforward job than doing the same task with Windows 10. Everything worked, including the fingerprint reader - no manual install of anything required.
- deleted 6y ago[deleted]
- franga2000 6y agoI've only had to touch iwconfig once (on a desktop OS) and it was when my network card wasn't even supported on Windows, so it was still a win for Linux. But yes, if something breaks, no shit you have to pull out the command line - it's the same on Windows, only a lot of the time, you can't actually fix it because they don't give you the necessary tools. As for suspend/resume scripts, I've never had to do that and I use Arch (yes, hahah, but you know what I mean).
- zeusk 6y agofunny you say that, because Arch is what had me learn about those monstrosities (suspend/resume scripts). Granted, it was back around 2011 though so I'm sure things have changed quite a bit since. Windows has a certification process for most hardware and drivers, things still break but any major or wide breaks are caught quite early. I just have less time to tinker with stuff when random flakiness pops up which happened a lot when I used Arch and Ubuntu.
- kbumsik 6y agoGlad to see I am not the only one. Windows desktop also has a big plus: native RDP is unparalleled compared to VNC or any other Linux remote desktop.
- franga2000 6y agoIt's true that VNC is a disaster, but RDP still feels miles behind thrid-party tech like TeamViewer. And doesn't MSFT stil cripple RDP on Home editions?
- tester34 6y agoIs it actually miles behind? I've used RDP to work remotely and also to play some games inside Hyper-V VM and I didn't felt big difference between native
- franga2000 6y agoI haven't used it much lately, but a few years back I was working on a Windows Server system (whichever was the version that was basically Windows 8) and remember it being really janky (latency spikes, image artifacts, etc.) over my pathetic DSL Internet connection. Then I noticed some other admin installed TeamViewer on it so I gave it a try and it was way faster and smoother so I switched to it permanently, despite the constant annoyances because we were too cheap to pay for a license. Admittedly, it's been almost a decade since Windows 8 (!?!), so this is a very dated experience.
- Isthatablackgsd 6y agoTechnically MSFT disabled the RDP server feature in Home edition, meaning you can't use Windows Home as RDP host (I am not sure the proper terminology for this). The software still in there, you only can use RDP client in Win Home, not the server aspect. It is just disabled without official way of enabling it (w/o upgrading to Pro). However there is way to get it enabled in Windows Home, it need rdpwrap by stascrop. Just download the file and run it. It will get the server aspect running. Rdpwrap by stascrop (GitHub) https://github.com/stascorp/rdpwrap/releases https://github.com/stascorp/rdpwrap/releases
- lambda_dn 6y agoI would be on KDE if I didn't have to use Visual Studio for my day job (project is still not fully .NET core). But WSL is a good compromise I use it as my shell for all git, dotnet related stuff.
- erklik 6y agoThis is pretty sweet. I feel like the only thing is that Windows Hello, and other fingerprint/face scanning tech is pretty slow compared to typing in a password, so doubt i'll be using it anytime soon. This is still very interesting from a technical pov. I know nothing of PAM, but could it be used with something like LDAP? or ActiveDirectory?
- MrMorden 6y agoBoth face and fingerprint authenticate in under a second on all the machines I use. If the machine is joined to a domain you'd need to use Hello for Business. It's more involved to set up, but if you've got enough Windows computers to have an AD domain you should definitely do it. https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-overview https://docs.microsoft.com/en-us/windows/security/identity-p...
- andrewmackrodt 6y agoI used Windows Hello for about a year with a Razer Stargazer (IR Camera) and was always impressed with how quickly it was able to auth me, no matter if I was wearing glasses or not. Less than a second for me too, and that camera does not have the fastest start time, from camera init to capturing from both RGB and IR cameras. At first I was skeptical about the usefulness of such a feature given my password doesn't take long to type, but it turned it to be a feature I really enjoyed.
- trissylegs 6y agoI have a IR camera built into my Dell Latitude. It's suprising at how quick it is. The only catch is that I'm usually loocking at my monitor and have to turn to the laptop for it to pick up.
- MetricMike 6y agoyep! PAM is "Pluggable Authentication Module" which sits between applications and the auth method, so you can put anything there. LDAP and ActiveDirectory are fairly common ones
- perryizgr8 6y agoThis looks easier to setup and use than using fingerprint for sudo on native Macos.
- swiley 6y agoEDIT: oops, this wasn't from MS.
- powersnail 6y agoThat's grossly unfair to the author of this project. This is not from Microsoft, but an individual developer.
- slondr 6y agoThe "individual developer" you're talking about is a former Microsoft employee
- JoBrad 6y agoSo Microsoft’s plan to extend Linux includes getting former employees to do it?
- eneville 6y agoWouldn't anyone with a pension or shares in a company want it to succeed?
- zeusk 6y agobut that's the employees sole intent, and not the "firm". People really get riled up with some brands, but I think brands are really just people who operate the brand collectively, often with an emphasis on the leadership that gets to guide the sail. Gates and Ballmer are past.
- eneville 6y agoHow is Gates past? Doesn't he still own the majority share but just someone else is the face of the company? I would assume, as a majority share holder, your interests and ethics would remain the same.
- rhplus 6y agoWhat kind of prompt is this? It looks like Windows Terminal running Bash, but are the icons PNGs (windows + home), or a specific type-face rendering emoji? https://github.com/nullpo-head/WSL-Hello-sudo/blob/master/demo.gif https://github.com/nullpo-head/WSL-Hello-sudo/blob/master/de...
- deleted 6y ago[deleted]
- throwaway8581 6y agoI’m going to repost this from the Mac thread: What exactly is the point of sudo/UAC these days of single-user machines? I think https://xkcd.com/1200 https://xkcd.com/1200 put it well. Anything running as an unelevated user account can access my browser sessions where it can steal my passwords, emails, other other private info. It can turn on my microphone and camera. It can read all of my documents. Those are the things I care about protecting, not whatever special things root can do like install drivers and create virtual network interfaces. The best configuration for WSL sudo is probably to just allow all commands without any authentication.
- kiwijamo 6y agoHave you forgotten what life was like before windows got UAC? Just because a machine is single user doesn't mean it's a good idea for all processes to run as root/Admin.
- fock 6y agoback then I remember that people generally had a single computer, used by the whole family! It's definitely not good for kids to trivially install a banking trojan when downloading stuff. Nowadays: all my data belongs to a single user, I am the only user on 5 machines. The only thing for which root is good, is to secure fw updating and deleting ZFS/BTRFS-snapshots. Unfortunately there's still setuid-binaried weakening this security model.
- kyriakos 6y agoEven a single user machine is really not single user because your applications are also users on your machine and being Internet connected/updated you better have control over what they can do.
- eneville 6y agoHello, author of please (https://gitlab.com/edneville/please https://gitlab.com/edneville/please) here, where I've taken a different approach to make permitting grnular things simple. Permiting everything is no different really to browsing the web as root. Permitting granular things in sudo and doas isn't easy. For what it is worth, many of the systems I work on on have many more than just one user and I am sure that other people work on bigger environments too. When you have multiple users, you run the risk of delegating more access than you should and thus compromise content, hence why I think access should simple!
- jjjeii3 6y agoTo me developing with WSL2 is now even better than on native Linux - works exceptionally well. I use it with VS Code + WSL plugin and Docker for Windows.
- anhner 6y agoHow do you deal with performance issues with files not on the linux machine?
- arcatek 6y agoI had this problem at first (I kept my source codes in a separate drive to be able to edit them from my Windows IDE), but nowadays I just keep all my code files in WSL and I don't notice the problem at all anymore. VSCode makes interacting with the box completely transparent.
- jjjeii3 6y agoThere is no performance issues with WSL2. It was only the case with the first version of WSL.
- timvrakas 6y agoThat's not the full story. WSL2 has serious regressions in cross-OS performance, and many users have switched back to WSL1, which supposedly isn't going away any time soon.
- quietbritishjim 6y agoWSL2 has better performance for accessing files in the WSL filesystem than WSL1 does (partly because the WSL files are stored differently). But it has worse performance for accessing native Windows files than WSL1 does. In any case I think an assertion that WSL2 has no performance issues needs a serious citation (as opposed to no citation which you gave) - you're making a claim about all possible situations. As always, a statement that "no x exists" requires seriously more proof than "at least one x does exist".
- 6y ago
- You-Are-Right 6y agohttps://reclaimyourface.eu https://reclaimyourface.eu
- Guillaume86 6y ago> The biometric data used to support Windows Hello is stored on the local device only. It doesn't roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise#:~:text=The%20biometric%20data%20used%20to,compromise%20to%20steal%20biometric%20data https://docs.microsoft.com/en-us/windows/security/identity-p....
- anaisbetts 6y agoWindows Hello is opt-in and also has many other providers other than facial recognition
- e12e 6y agoClearly the better use case is with sshd, rather than sudo. Accept logins via ssh only when you are in front of the computer! ;)