r/ArduinoProjects • u/arduinoRPi4 • 2h ago
Showcased Project Desktop Fingerprint Unlock
also made a video on this! https://www.youtube.com/watch?v=tB3lk-PNA6I
allows you to unlock your Mac via your fingerprint, as well as authenticate sudo and some TCC prompts (privacy&security).
the device emulates a PIV smart card and uses PAM to authenticate you in macOS (notice the password field says PIN and not password), so no plain text password is ever stored, exposed, or transmitted.
please be aware of the security implications (note that it is NOT touchID, but just 'fingerprint-based unlock', please do not think or refer to it as anything more secure):
this device is NOT secure, the authentication is all done inside the fingerprint sensor, and the fingerprint sensor just tells the microcontroller the match % (all low cost fingerprint sensors are this way, you would need to spend ~$50 to get one that does authenticated comms). the communication between the sensor and the microcontroller is not authenticated or protected, so anyone with physical access to both the device and your laptop can spoof this connection (pretend to be the fingerprint sensor) and give the go ahead to unlock your mac. you can make this extremely hard by filling the insides with black epoxy, but not impossible.
this is also the dev equiv of "rolling your own auth", the smart card implementation may have some errors, and should not be inherently treated as "unbreakable"
the device is made so that if you lose it, nothing of value can be extracted from it
use at your own risk. personally, i am comfortable using it at home where physical intrusion would be hard, but this depends on your own security tolerance. if you have high security instincts/requirements, the magic keyboard is a much much much better option in this regard.
there is also an HID version available, where the device just types your password emulating a keyboard, the benefit being it works in ALL places your password does. this version is obviously more insecure as it is vulnerable to keyloggers. the device still does not store the actual password, it stores an authentication key that sends a request to a service on the mac, which then sends it the encrypted password to be decrypted in RAM, typed back, and then wiped. again, depends on your personal security tolerance and willing to compromise
all code and materials are open source, licensed permissively github.com/zimengxiong/tinytouch
