Re:Use Touch ID for Sudo on Mac
by samatman on Monday March 01, 2021 @05:50PM
(#26309568)
This is correct only in the instance that a biometric is stored on the host.
In TouchID, the biometric is stored only in the secure enclave, and is used to generate a private key signature, which serves as the password.
Additionally, it's always possible to reset TouchID to an unauthenticated state, where it will refuse a fingerprint read until the password is typed in.
There's no sense cargo-culting this bit of conventional wisdom without understanding where it comes from, and what sort of attacks it is meant to prevent.
In TouchID, the biometric is stored only in the secure enclave, and is used to generate a private key signature, which serves as the password.
Additionally, it's always possible to reset TouchID to an unauthenticated state, where it will refuse a fingerprint read until the password is typed in.
There's no sense cargo-culting this bit of conventional wisdom without understanding where it comes from, and what sort of attacks it is meant to prevent.