0

I want a command to force password input after sleep or manual lock with ControlCommandQ in High Sierra, as opposed to allowing TouchID alone to unlock the laptop.

How?

Use case:

  • You can be forced to supply your biometrics, but you can't be forced to supply your knowledge of a password, until mind-reading is a thing. Hence; when traveling, knowing that other people want to read/copy data contained on travelers' laptops, I want to secure my laptop by forcing authentication with username+password, as opposed to username+fingerprint.

Like for iOS 11 but for macOS.

Goal:

  • Disable TouchID every time I want to force a password-based unlock, until the next time the laptop has been successfully unlocked.

Facts:

  • I can lock the laptop and sign in with password if I click the avatar
  • I can lock the laptop and unlock it with my fingerprint if I touch the Touch Id sensor.
  • I have no way to force password on sign-in. That is what this question is about.

Discourse:

There are two concepts in play here. What principal is trying to log in and what credentials versus identification that principal supplies. The principal in the above use-case is always myself, but TouchId does away with the secret part of the credential, and makes it so that authentication is successful by merely supplying a username—the fingerprint. In the triad, "something you have, something you know, something you are", it has replaced the "something you know" with "something you are". In the above threat-model, it has lessened security, because "what you are" is never possible for you to withhold.

Furthermore; because fingerprints are available on your phone, on the surface of your laptop, on your wallet, etc, I don't even "have to be", for the laptop to open, because they can be stolen or faked.

They are a fairly strongly identifying (one to two in a hundred people could share the same hash of the fingerprint); but they are not strongly authenticating. I want strong authentication using a secret ("what I know"), to be possible. That is what I'm asking for.

I hope this removes any doubts about what this question is asking.

Notes:

You can't input commands after your computer is locked.

Sure I can; normally cabled ethernet is trusted: https://github.com/lgandx/Responder https://room362.com/post/2016/snagging-creds-from-locked-machines/ or a while back, now fixed: https://support.apple.com/en-us/HT207423

...if you could it would lessen security...

Not if the command can only strengthen security.

Besides, this is not what I'm asking about, I'm after a command for "strong lock machine", to enforce password-based authentication after sleep/lock/hibernate.

This is a duplicate post

No, it's not.

Typing is less secure since it can be observed and replicated

That is true for other threat modelling scenarios than I have as my use case. However, enabling 2FA (e.g. TouchId + password) for the laptop is a valid solution to this question, if it's possible.

  • Do not repost a closed question as new. Original qustion: apple.stackexchange.com/posts/315679/revisions – Allan Feb 18 '18 at 12:25
  • It's not the same question. And you should have thought about that before you closed the other question, shouldn't you? – Henrik Feb 18 '18 at 12:26
  • 2
    Typing a password is less secure. Typing can be observed and replicated. Also, I don't understand the "use case". – Tyson Feb 18 '18 at 12:38
  • @Tyson — I've addressed your feedback in the question. I've also answered the question; upvotes gladly accepted! – Henrik Feb 18 '18 at 14:36
  • 1
    That use case is very weak. Turn on FileVault disk encryption which requires a password. Securing your laptop with nothing but user credentials does absolutely nothing to prevent "officials" from accessing your disk and data with/without your password. – Allan Feb 18 '18 at 19:04
1
  1. After locking your laptop with Command+Control+Q, touch (don't depress) the Touch Id sensor five times with the wrong finger. Now Touch Id is temporarily disabled until you input your password.
  2. Reboot the machine; now you must input your password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .