Hacker News Reader

Comment by jszymborski | Hacker News Reader

> A note on security > This package is in no way as secure as a password and will never be. Although it's harder to fool than normal face recognition, a person who looks similar to you, or a well-printed photo of you could be enough to do it. Howdy is a more quick and convenient way of logging in, not a more secure one.

Congrats to the author(s) for shipping a library, and having done so for some time now it seems (which is more than I've ever done).

Can I ask if there's much of a point, though? Like why bother with the trouble of setting this up if I can just print a photo and have it unlock? At that point you're better off with a very weak and easy-to-remember password, no?

View on HN

Depends on the level of security you need. This would be enough for my personal laptop, where it's unlikely that I would be targeted by someone, even more so with the skills and time to go and bypass the protection, all that to access my hn account and the half dozen code bases I work on that are already open source. My password manager locks itself whenever I lock the computer, and my webmail has a 1h session. It is much more likely that it would be captured as part of a robbery, or stolen in a cafe, and be resold on craigslist, in which case this level of security is probably sufficient.

My professional laptop could be different if I was working on something of any importance. That is not the case, but there the risk reward is different, and I would probably keep it to password + sec key or something in these lines

I wish I could restrict it to NOT working everywhere PAM works.

For instance, only face-unlock my screen if it locked for inactivity, and less than 15 minutes ago. If I manually locked it, require password. If I've been gone too long, require password. For sudo and bootup, always require password.

That would make the level of (in)security acceptable to me. In its present state, I don't think it's appropriate.

I was gonna say well, of course you should be able to configure it within PAM to only be used for certain authentication types, but it turns out one of the literally five pages in the wiki covers just that: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-...

And for anything PAM doesn't handle, since Howdy is just a Python lib/app, it's almost trivial to modify it to do anything else. You could just add your modifications into https://github.com/boltgolt/howdy/blob/beta/howdy/src/compar... (eg, make it autofail if a env/memory flag hasn't been set after first login, same with storing an inactivity flag, etc. Looks like the author is responsive taking pull requests, so you could even do it properly and get it upstreamed even: https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclose...

As for appropriateness, it's fine if it's not your cup of tea, but with 3.6K stars and 220 forks, obviously it works great/is useful for a lot of people so I'm glad that the author released and maintains it, even if it's not for everyone.

Whoah.

Okay, thank you, I had not found that page in a brief glance. Which admittedly was probably not enough of a glance to give it a fair shot.

That's pretty awesome, I will have to poke at it. I also have fingerprint login so I'm sure I can get up to some silly hijinks...

You can though: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-...

I think it would be interesting if logind was able to track such indications (locked because of inactivity, or due to smart card being removed, or because the system was moved outside of a geofence, or because Kerberos TGT expired), then a pam module could query logind in order to skip over pam_howdy.so based on the desired conditions.

I've wanted that for some time with sssd (e.g., unlock with a single factor if my TGT is still valid) but never got around to filing the right RFEs.

At a first glance, it seems like a well done authentication system that handles video capture, integration with PAM, the workflow for managing faces/users, etc.

As models evolve, they could be integrated without changing the other components.

Also, I'd be curious to see how it compares to, say, Windows Hello. The nice thing about it being open source is you can change the confidence threshold for matching a face, and see the impact.

AFAIK Windows hello uses an array of IR sensors to map the contours of your face, which is why "a well printed photo" doesn't fool it. this on the other hand, is based on face recognition and identification in the video feed from your webcam.

It really does not, it's simply identifying you from a picture: https://docs.microsoft.com/en-us/windows-hardware/design/dev... Notice how Microsoft shows how Hello can't be fooled by phones or by a picture. Howdy uses the same IR camera of course and thus would also not be fooled by that picture. Some (industrial) printers DO print in the IR-spectrum and can fool both.

thank you! I learned a lot from this comment... including that it's possible to print the IR spectrum. Amazing.

It's all about your threat model. The lock on your front door doesn't prevent someone with the right tools from getting in either, but it still provides meaningful security against large groups of potential attackers.

FWIW, Windows Hello does try to defend against this attack by requiring special cameras that operate in the infrared band.

Howdy also says it will use infrared cameras if you have them.

The point is that some people want it despite its obvious flaws, and now they have it.

>> Like why bother with the trouble of setting this up if I can just print a photo and have it unlock?

The question is - who are you trying to protect against?

Like, personally I'm worried about someone stealing my laptop. In that case, it's extremely unlikely the thief would have a photo of me to use to unlock the laptop. Yes my wife or my friends would have access to pictures of me in high enough resolution to print and use to unlock it - but I'm really not worried about them breaking in.

I'm also willing to bet good money 99% of criminals don't care about the data and just want to flip it for cash.

Unless you're being targeted by someone, of course. In that case you have way more problems to worry about than your laptop being unlocked...

It claims to:

> Use your built-in IR emitters and camera in combination with facial recognition to prove who you are.

I wonder if the "could be enough to do it" is kind of pessimistic. That is, it is open source software -- you can install it on whatever computer you want, including one without an advanced IR camera. Or, the user could have some obscure IR camera, which might not be detected properly/might not have Linux drivers. It seems hard to make guarantees for arbitrary hardware.

It's very pessimistic, no false positive reports over the last four years but i rather set expectations low.

Could be handy for having a computer the kids can use, just look at it and unlock it - dunno if that's easier than '123456' or no passwords, but I can see certain scenarios where a simple face match to unlock something would be cool

I wonder how it compares to windows Hello in terms of these attacks.

Windows Hello requires specific hardware that, among other things, uses IR imaging to make it much more difficult to spoof.

More difficult, but if you can capture an IR image of the user, it can be fed in directly if you have a device designed to spoof a USB webcam. A really interesting writeup from last year: https://www.cyberark.com/resources/threat-research-blog/bypa...

I'm still wary of biometrics for authentication no matter how difficult to spoof. They are also painful to revoke...

Reply on news.ycombinator.com