uliwitness, 20 days ago

@davemark Apple has built in some protections for login (to allow you to shut down your Mac to make sure customs can't make you unlock your Mac with your fingerprint).

As to installations, I think some really security relevant things are behind the password only for similar reasons.

Also, if it's a third-party installer, they often ask for your password because they're just scripts running sudo, and can’t feed a fingerprint into the command line, only text, basically.

Chancerubbage, 20 days ago

@davemark I have seen requests for extra authentication when logging in via a vpn. It happens when I visit my sisters home. It’s irritating.

I think there may be an extra layer of associated known IP addresses, and seeing that new novel IP via a VPN is alerting an extra security measure?

chrisgervais, 20 days ago

@davemark Have you done the thing to add TouchID support to pam.d for sudoers?

davemark, 20 days ago

@chrisgervais No, but just learned that was a thing.

parpok, 20 days ago

@davemark Its kind of stupid but the Touch ID thing isn't treated as a thing to allow sudo access but it can be allowed by changing couple variables

https://apple.stackexchange.com/questions/259093/can-touch-id-on-mac-authenticate-sudo-in-terminal

davemark, 20 days ago

@parpok Fascinating!

craiggrannell, 20 days ago

@davemark Yeah, but what if someone has STOLEN YOUR FINGER? You clearly haven’t thought this through.

(Also: yes. I agree. The sheer number of times I need to tap in my Apple ID and/or Mac password is annoying at best and feels like a security issue at worst.)

davemark, 20 days ago

@craiggrannell "STOLEN YOUR FINGER". Sounds like a plot to a Guy Ritchie movie. 🍿

craiggrannell, 20 days ago

@davemark Or possibly the central plot (such as it is) to Crank 3.