For what it's worth, if you have a system with the T1 chip (Apple's been using the watch chip rebadged as a T1 for a few years as a SSD controller+security module), you can both unlock your laptop with your watch (built-in to the OS) and as a biometric sudo auth[0].

[0] https://github.com/insidegui/pam-watchid

I don't have a watch and I don't want someone else's code accessing my TouchID :)

> I wish they added "unlock Mac/use id on Mac with iPhone".

Me too. So I made a program that does exactly that: https://www.gadgetish.com/osx.html

It also works with Android phones, Android Wear watches, Tizen (Samsung) watches, ... even some earbuds or smart tags.

This sounds insecure. Do you store the user’s password on disk?

No, I store on OS-X's keychain.

You made a fair and necessary question but I'd be embarrassed to even think about storing the password on disk, even if encrypted.

Unless you’re on a machine with a hardware security module, isn’t keychain just stored somewhere on disk anyway?