5 ms·

> A note on security > This package is in no way as secure as a password and will never be. Although it's harder to fool than normal face recognition, a person

> A note on security > This package is in no way as secure as a password and will never be. Although it's harder to fool than normal face recognition, a person who looks similar to you, or a well-printed photo of you could be enough to do it. Howdy is a more quick and convenient way of logging in, not a more secure one. Congrats to the author(s) for shipping a library, and having done so for some time now it seems (which is more than I've ever done). Can I ask if there's much of a point, though? Like why bother with the trouble of setting this up if I can just print a photo and have it unlock? At that point you're better off with a very weak and easy-to-remember password, no?

spicybright 5y ago
I wonder how it compares to windows Hello in terms of these attacks.
- Arainach 5y ago
  Windows Hello requires specific hardware that, among other things, uses IR imaging to make it much more difficult to spoof.
  - dspillett 5y ago
    I'm still wary of biometrics for authentication no matter how difficult to spoof. They are also painful to revoke...
  - lhl 5y ago
    More difficult, but if you can capture an IR image of the user, it can be fed in directly if you have a device designed to spoof a USB webcam. A really interesting writeup from last year: https://www.cyberark.com/resources/threat-research-blog/bypassing-windows-hello-without-masks-or-plastic-surgery https://www.cyberark.com/resources/threat-research-blog/bypa...
TYPE_FASTER 5y ago
At a first glance, it seems like a well done authentication system that handles video capture, integration with PAM, the workflow for managing faces/users, etc. As models evolve, they could be integrated without changing the other components. Also, I'd be curious to see how it compares to, say, Windows Hello. The nice thing about it being open source is you can change the confidence threshold for matching a face, and see the impact.
- ohthehugemanate 5y ago
  AFAIK Windows hello uses an array of IR sensors to map the contours of your face, which is why "a well printed photo" doesn't fool it. this on the other hand, is based on face recognition and identification in the video feed from your webcam.
  - Boltgolt 5y ago
    It really does not, it's simply identifying you from a picture: https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/windows-hello-face-authentication#how-it-works https://docs.microsoft.com/en-us/windows-hardware/design/dev... Notice how Microsoft shows how Hello can't be fooled by phones or by a picture. Howdy uses the same IR camera of course and thus would also not be fooled by that picture. Some (industrial) printers DO print in the IR-spectrum and can fool both.
    - ohthehugemanate 5y ago
      thank you! I learned a lot from this comment... including that it's possible to print the IR spectrum. Amazing.
bee_rider 5y ago
It claims to: > Use your built-in IR emitters and camera in combination with facial recognition to prove who you are. I wonder if the "could be enough to do it" is kind of pessimistic. That is, it is open source software -- you can install it on whatever computer you want, including one without an advanced IR camera. Or, the user could have some obscure IR camera, which might not be detected properly/might not have Linux drivers. It seems hard to make guarantees for arbitrary hardware.
- Boltgolt 5y ago
  It's very pessimistic, no false positive reports over the last four years but i rather set expectations low.
JasonFruit 5y ago
The point is that some people want it despite its obvious flaws, and now they have it.
charles_f 5y ago
Depends on the level of security you need. This would be enough for my personal laptop, where it's unlikely that I would be targeted by someone, even more so with the skills and time to go and bypass the protection, all that to access my hn account and the half dozen code bases I work on that are already open source. My password manager locks itself whenever I lock the computer, and my webmail has a 1h session. It is much more likely that it would be captured as part of a robbery, or stolen in a cafe, and be resold on craigslist, in which case this level of security is probably sufficient. My professional laptop could be different if I was working on something of any importance. That is not the case, but there the risk reward is different, and I would probably keep it to password + sec key or something in these lines
- myself248 5y ago
  I wish I could restrict it to NOT working everywhere PAM works. For instance, only face-unlock my screen if it locked for inactivity, and less than 15 minutes ago. If I manually locked it, require password. If I've been gone too long, require password. For sudo and bootup, always require password. That would make the level of (in)security acceptable to me. In its present state, I don't think it's appropriate.
  - mminer237 5y ago
    You can though: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-specific-authentication-types https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-...
  - lhl 5y ago
    I was gonna say well, of course you should be able to configure it within PAM to only be used for certain authentication types, but it turns out one of the literally five pages in the wiki covers just that: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-specific-authentication-types https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-... And for anything PAM doesn't handle, since Howdy is just a Python lib/app, it's almost trivial to modify it to do anything else. You could just add your modifications into https://github.com/boltgolt/howdy/blob/beta/howdy/src/compare.py https://github.com/boltgolt/howdy/blob/beta/howdy/src/compar... (eg, make it autofail if a env/memory flag hasn't been set after first login, same with storing an inactivity flag, etc. Looks like the author is responsive taking pull requests, so you could even do it properly and get it upstreamed even: https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclosed https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclose... As for appropriateness, it's fine if it's not your cup of tea, but with 3.6K stars and 220 forks, obviously it works great/is useful for a lot of people so I'm glad that the author released and maintains it, even if it's not for everyone.
bennyp101 5y ago
Could be handy for having a computer the kids can use, just look at it and unlock it - dunno if that's easier than '123456' or no passwords, but I can see certain scenarios where a simple face match to unlock something would be cool
legalcorrection 5y ago
It's all about your threat model. The lock on your front door doesn't prevent someone with the right tools from getting in either, but it still provides meaningful security against large groups of potential attackers. FWIW, Windows Hello does try to defend against this attack by requiring special cameras that operate in the infrared band.
- mminer237 5y ago
  Howdy also says it will use infrared cameras if you have them.
gambiting 5y ago
>> Like why bother with the trouble of setting this up if I can just print a photo and have it unlock? The question is - who are you trying to protect against? Like, personally I'm worried about someone stealing my laptop. In that case, it's extremely unlikely the thief would have a photo of me to use to unlock the laptop. Yes my wife or my friends would have access to pictures of me in high enough resolution to print and use to unlock it - but I'm really not worried about them breaking in.
- spicybright 5y ago
  I'm also willing to bet good money 99% of criminals don't care about the data and just want to flip it for cash. Unless you're being targeted by someone, of course. In that case you have way more problems to worry about than your laptop being unlocked...

spicybright 5y ago

I wonder how it compares to windows Hello in terms of these attacks.

Arainach 5y ago
Windows Hello requires specific hardware that, among other things, uses IR imaging to make it much more difficult to spoof.
- dspillett 5y ago
  I'm still wary of biometrics for authentication no matter how difficult to spoof. They are also painful to revoke...
- lhl 5y ago
  More difficult, but if you can capture an IR image of the user, it can be fed in directly if you have a device designed to spoof a USB webcam. A really interesting writeup from last year: https://www.cyberark.com/resources/threat-research-blog/bypassing-windows-hello-without-masks-or-plastic-surgery https://www.cyberark.com/resources/threat-research-blog/bypa...

TYPE_FASTER 5y ago

At a first glance, it seems like a well done authentication system that handles video capture, integration with PAM, the workflow for managing faces/users, etc. As models evolve, they could be integrated without changing the other components. Also, I'd be curious to see how it compares to, say, Windows Hello. The nice thing about it being open source is you can change the confidence threshold for matching a face, and see the impact.

ohthehugemanate 5y ago
AFAIK Windows hello uses an array of IR sensors to map the contours of your face, which is why "a well printed photo" doesn't fool it. this on the other hand, is based on face recognition and identification in the video feed from your webcam.
- Boltgolt 5y ago
  It really does not, it's simply identifying you from a picture: https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/windows-hello-face-authentication#how-it-works https://docs.microsoft.com/en-us/windows-hardware/design/dev... Notice how Microsoft shows how Hello can't be fooled by phones or by a picture. Howdy uses the same IR camera of course and thus would also not be fooled by that picture. Some (industrial) printers DO print in the IR-spectrum and can fool both.
  - ohthehugemanate 5y ago
    thank you! I learned a lot from this comment... including that it's possible to print the IR spectrum. Amazing.

bee_rider 5y ago

It claims to: > Use your built-in IR emitters and camera in combination with facial recognition to prove who you are. I wonder if the "could be enough to do it" is kind of pessimistic. That is, it is open source software -- you can install it on whatever computer you want, including one without an advanced IR camera. Or, the user could have some obscure IR camera, which might not be detected properly/might not have Linux drivers. It seems hard to make guarantees for arbitrary hardware.

Boltgolt 5y ago
It's very pessimistic, no false positive reports over the last four years but i rather set expectations low.

JasonFruit 5y ago

The point is that some people want it despite its obvious flaws, and now they have it.

charles_f 5y ago

Depends on the level of security you need. This would be enough for my personal laptop, where it's unlikely that I would be targeted by someone, even more so with the skills and time to go and bypass the protection, all that to access my hn account and the half dozen code bases I work on that are already open source. My password manager locks itself whenever I lock the computer, and my webmail has a 1h session. It is much more likely that it would be captured as part of a robbery, or stolen in a cafe, and be resold on craigslist, in which case this level of security is probably sufficient. My professional laptop could be different if I was working on something of any importance. That is not the case, but there the risk reward is different, and I would probably keep it to password + sec key or something in these lines

myself248 5y ago
I wish I could restrict it to NOT working everywhere PAM works. For instance, only face-unlock my screen if it locked for inactivity, and less than 15 minutes ago. If I manually locked it, require password. If I've been gone too long, require password. For sudo and bootup, always require password. That would make the level of (in)security acceptable to me. In its present state, I don't think it's appropriate.
- mminer237 5y ago
  You can though: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-specific-authentication-types https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-...
- lhl 5y ago
  I was gonna say well, of course you should be able to configure it within PAM to only be used for certain authentication types, but it turns out one of the literally five pages in the wiki covers just that: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-specific-authentication-types https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-... And for anything PAM doesn't handle, since Howdy is just a Python lib/app, it's almost trivial to modify it to do anything else. You could just add your modifications into https://github.com/boltgolt/howdy/blob/beta/howdy/src/compare.py https://github.com/boltgolt/howdy/blob/beta/howdy/src/compar... (eg, make it autofail if a env/memory flag hasn't been set after first login, same with storing an inactivity flag, etc. Looks like the author is responsive taking pull requests, so you could even do it properly and get it upstreamed even: https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclosed https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclose... As for appropriateness, it's fine if it's not your cup of tea, but with 3.6K stars and 220 forks, obviously it works great/is useful for a lot of people so I'm glad that the author released and maintains it, even if it's not for everyone.

bennyp101 5y ago

Could be handy for having a computer the kids can use, just look at it and unlock it - dunno if that's easier than '123456' or no passwords, but I can see certain scenarios where a simple face match to unlock something would be cool

legalcorrection 5y ago

It's all about your threat model. The lock on your front door doesn't prevent someone with the right tools from getting in either, but it still provides meaningful security against large groups of potential attackers. FWIW, Windows Hello does try to defend against this attack by requiring special cameras that operate in the infrared band.

mminer237 5y ago
Howdy also says it will use infrared cameras if you have them.

gambiting 5y ago

>> Like why bother with the trouble of setting this up if I can just print a photo and have it unlock? The question is - who are you trying to protect against? Like, personally I'm worried about someone stealing my laptop. In that case, it's extremely unlikely the thief would have a photo of me to use to unlock the laptop. Yes my wife or my friends would have access to pictures of me in high enough resolution to print and use to unlock it - but I'm really not worried about them breaking in.

spicybright 5y ago
I'm also willing to bet good money 99% of criminals don't care about the data and just want to flip it for cash. Unless you're being targeted by someone, of course. In that case you have way more problems to worry about than your laptop being unlocked...