Hey, cool project and thank you for what you're doing. It would be great if the fingerprint reader worked for unlocking the Apple Keychain. Right now it asks me to insert a key instead of prompting for my fingerprint, and I'd love to see that supported.
Activity
7
rohrig1mo agoI've got it working. Let me know if you want a pull request. As I say in the video, it probably not the best code so I don't want to submit it and make you review slop. But if you'd like it for inspriation, I'll gladly share it. https://youtu.be/7h7I0aQ4D-M
rohrig1mo agoI should add, it does not use the Apple keychain directly. It does use the built-in fingerprint reader, but you have to create new passkeys as if it's a separate computer. So I think the comment above does like have some validity to it. But if you're just wanting to be able to log into site with the passkey, this is possible.
Fail-Safe1mo ago@rohrig Awesome--kudos! I would love to see the code you've got for your working demo if you're able to share it. Do you have a fork with a branch you could link here?
themartiano1mo agoRelated progress: merged PR #143 adds opt-in Touch ID authentication for guest sudo, configured through Setup → Security → Touch ID for sudo.
Its scope is sudo authentication only. It does not expose Apple Passwords/Keychain, implement browser passkeys, or replace guest login/screen-unlock authentication. Leaving this issue open for the requested Keychain/passkey integration.
themartiano1mo agoI've got it working. Let me know if you want a pull request. As I say in the video, it probably not the best code so I don't want to submit it and make you review slop. But if you'd like it for inspriation, I'll gladly share it. https://youtu.be/7h7I0aQ4D-M
Hey! Please do open the PR, even if it is a starting point for the feature. This is very welcome @rohrig
rohrig28d agoHey, bad news. I didn't get notified of these responses and I've since wiped all of that off of my computer to save space. 🤦 Sorry for the inconvenience. I can assure you it's possible and I wish you the best of luck in recreating it, but it's lost my interest so I won't be recreating it.
Preface: I am not associated with this project in any official capacity, so my response is strictly my opinion and not meant to give any indication as to the project's actual roadmap.
With that out of the way, as an enthusiast of this project, I love the idea and would love to see this work. However, this is a lot more challenging than it may appear at first.
My understanding is Touch ID isn't a USB fingerprint reader. It is cryptographically paired with the Mac's Secure Enclave. Applications receive an authentication result, not fingerprint data or a device that QEMU can forward to the guest OS. Apple documents this boundary explicitly here.
Not sure if you're familiar with the Asahi Linux project for Mac, but even with the incredible level of bare-metal/native functionality they were able to tap into for the M1 & M2 series hardware, Touch ID is still called out as an unusable function.
Who knows, though. Maybe there's a devil in the details somewhere that someone can find that changes this story. 🙂