5 ms·
I really like the way 1Password and MacOS work together for security [0]. Even if my laptop is unlocked, each 1Password interaction needs my fingerprint. That
by ddulaney 4y ago
I really like the way 1Password and MacOS work together for security [0].
Even if my laptop is unlocked, each 1Password interaction needs my fingerprint. That unlocks a secret stored in the Secure Enclave, which I trust. (Security is hard and flaws are possible, but Apple has done a reasonably good job here from what I can tell.) I only have to mess around with typing a long string of nonsense in when I'm registering a new device, rather than every time I want to use my SSH or GPG key (or trusting an agent to hold it in memory, which... I'll do it, but I won't like it).
I wish I could rely on similar things from Linux, but the user experience just isn't there on the desktop. A previous employer issued laptops that had both a fingerprint reader and some kind of HSM, so the hardware was there, but I remember both of them missing drivers at the time, and even with drivers the userland software support would've been very hacky.
[0]: https://support.1password.com/touch-id-apple-watch-security-mac/ https://support.1password.com/touch-id-apple-watch-security-...
- KennyBlanken 4y agoKeepassXC does the same thing. Once you enter your password, you can unlock with your fingerprint.
- andrewaylett 4y agoBitwarden's fingerprint integration does exactly the same.
- lxgr 4y agoGiven that, really the only thing that Bitwarden would have needed to do is to clearly label the PIN feature as being much less secure than the biometry option, especially when used in combination with the "do not ask for passphrase after browser restarts" option, which persists an only PIN-encrypted version of the master encryption key to disk.
- andrewaylett 4y agoAgreed -- I happily use biometric unlock, but there's no way I'd turn on PIN unlock.
- Takennickname 4y agoFingerprinting and everything work perfectly fine on Fedora with the ThinkPad's built in fingerprint scanner.
- lxgr 4y agoInteresting, how can fingerprints be used as a cryptographic unlocking method on Linux? Does this involve the TPM somehow, or does the security model assume a non-compromised userspace and/or kernel?
- Takennickname 4y agoI don't know about all of linux, but default Fedora (gnome keyring) appears to support TPM since 2016.