I want a command to force password input after sleep or manual lock with ControlCommandQ in High Sierra, as opposed to allowing TouchID alone to unlock the laptop.


Use case:

  • You can be forced to supply your biometrics, but you can't be forced to supply your knowledge of a password, until mind-reading is a thing. Hence; when traveling, knowing that other people want to read/copy data contained on travelers' laptops, I want to secure my laptop by forcing authentication with username+password, as opposed to username+fingerprint.

Like for iOS 11 but for macOS.


  • Disable TouchID every time I want to force a password-based unlock, until the next time the laptop has been successfully unlocked.


  • I can lock the laptop and sign in with password if I click the avatar
  • I can lock the laptop and unlock it with my fingerprint if I touch the Touch Id sensor.
  • I have no way to force password on sign-in. That is what this question is about.


There are two concepts in play here. What principal is trying to log in and what credentials versus identification that principal supplies. The principal in the above use-case is always myself, but TouchId does away with the secret part of the credential, and makes it so that authentication is successful by merely supplying a username—the fingerprint. In the triad, "something you have, something you know, something you are", it has replaced the "something you know" with "something you are". In the above threat-model, it has lessened security, because "what you are" is never possible for you to withhold.

Furthermore; because fingerprints are available on your phone, on the surface of your laptop, on your wallet, etc, I don't even "have to be", for the laptop to open, because they can be stolen or faked.

They are a fairly strongly identifying (one to two in a hundred people could share the same hash of the fingerprint); but they are not strongly authenticating. I want strong authentication using a secret ("what I know"), to be possible. That is what I'm asking for.

I hope this removes any doubts about what this question is asking.


You can't input commands after your computer is locked.

Sure I can; normally cabled ethernet is trusted: https://github.com/lgandx/Responder https://room362.com/post/2016/snagging-creds-from-locked-machines/ or a while back, now fixed: https://support.apple.com/en-us/HT207423

...if you could it would lessen security...

Not if the command can only strengthen security.

Besides, this is not what I'm asking about, I'm after a command for "strong lock machine", to enforce password-based authentication after sleep/lock/hibernate.

This is a duplicate post

No, it's not.

Typing is less secure since it can be observed and replicated

That is true for other threat modelling scenarios than I have as my use case. However, enabling 2FA (e.g. TouchId + password) for the laptop is a valid solution to this question, if it's possible.

  • Do not repost a closed question as new. Original qustion: apple.stackexchange.com/posts/315679/revisions
    – Allan
    Feb 18, 2018 at 12:25
  • It's not the same question. And you should have thought about that before you closed the other question, shouldn't you?
    – Henrik
    Feb 18, 2018 at 12:26
  • 2
    Typing a password is less secure. Typing can be observed and replicated. Also, I don't understand the "use case".
    – Tyson
    Feb 18, 2018 at 12:38
  • @Tyson — I've addressed your feedback in the question. I've also answered the question; upvotes gladly accepted!
    – Henrik
    Feb 18, 2018 at 14:36
  • 1
    That use case is very weak. Turn on FileVault disk encryption which requires a password. Securing your laptop with nothing but user credentials does absolutely nothing to prevent "officials" from accessing your disk and data with/without your password.
    – Allan
    Feb 18, 2018 at 19:04

1 Answer 1

  1. After locking your laptop with Command+Control+Q, touch (don't depress) the Touch Id sensor five times with the wrong finger. Now Touch Id is temporarily disabled until you input your password.
  2. Reboot the machine; now you must input your password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .