4 ms·

I will only use biometrics for authentication on a device that does 3 things: 1. if the device is turned off, I have to enter my passcode/password to enable bi

I will only use biometrics for authentication on a device that does 3 things: 1. if the device is turned off, I have to enter my passcode/password to enable biometrics authentication. 2. If after long enough of being on the biometrics are not used, it will require the passcode/password. 3. There is a quick shortcut to disable biometric authentication. To my knowledge iOS is the only one that does all 3. Mac does the first 2 for TouchID and annoyingly there is not a shortcut for the third available. Windows Hello seems like a half assed security measure since it is missing all 3. At quick glance this does the same.

jeroenhd 5y ago
My Xiaomi does that too, although the quick shortcut is to just hold the power button down to force reboot it. I think it's just the PC space missing support for this. However, I think the emergency disable functionality in Windows Hello isn't really necessary. You can quickly disable biometrics on your phone from your pocket, but disabling it on a desktop or laptop is a lot harder to do inconspicuously. Because this is using PAM, you can configure it however you want. You can tell your system to allow user logins through biometrics but require a password for administrative tasks (doas/sudo) for example. You can also edit the source code and make it always fail if a certain file in a write-only directory is present and set up a keyboard shortcut that runs `touch /special/file/here`. You can even implement such a timer system by setting up a systemd timer that automatically creates such a file after a certain amount of time to make sure you need to reauthenticate. Setting up a reliable face recognition system that hooks into the right APIs is the hard part. That's what this project does. Customising it to serve your exact use case is relatively easy.
NoGravitas 5y ago
Android does all three, though there's no way to configure the timeout for (2), and the timeout seems inappropriately long (72 hours). At least, all these are the case on the Moto builds of Android 10. Could be different on other manufacturers.

jeroenhd 5y ago

My Xiaomi does that too, although the quick shortcut is to just hold the power button down to force reboot it. I think it's just the PC space missing support for this. However, I think the emergency disable functionality in Windows Hello isn't really necessary. You can quickly disable biometrics on your phone from your pocket, but disabling it on a desktop or laptop is a lot harder to do inconspicuously. Because this is using PAM, you can configure it however you want. You can tell your system to allow user logins through biometrics but require a password for administrative tasks (doas/sudo) for example. You can also edit the source code and make it always fail if a certain file in a write-only directory is present and set up a keyboard shortcut that runs `touch /special/file/here`. You can even implement such a timer system by setting up a systemd timer that automatically creates such a file after a certain amount of time to make sure you need to reauthenticate. Setting up a reliable face recognition system that hooks into the right APIs is the hard part. That's what this project does. Customising it to serve your exact use case is relatively easy.

NoGravitas 5y ago

Android does all three, though there's no way to configure the timeout for (2), and the timeout seems inappropriately long (72 hours). At least, all these are the case on the Moto builds of Android 10. Could be different on other manufacturers.