Allow using fingerprint if it's registered

[cassidyjames]

I'm not sure how all of the PAM stuff works, but if a fingerprint is registered for the user, we should prefer that for authentication flows. It could look something like this:

"Use Password" would show the current password dialog instead.

[cassidyjames]

Sample dialog code from my mockup is at https://github.com/cassidyjames/agents/blob/master/src/BiometricDialog.vala

[arshubham]

This looks great as of today. But maybe the dialog mockup also take care of other authentication methods which elementary may support in the future like Pins, Hardware Keys, IR Cameras (If somebody brings Windows Hello support to linux). Just a thought to be future ready. Maybe it can have a dropdown for alternative authentication methods.

[cassidyjames]

@arshubham The code in my sample dialog is written in a way that could be easily expanded to multiple authentication types. An icon, authentication summary, and detailed description are passed in and used.

private const string BIO_AUTH_ICON = "fingerprint-symbolic";
private const string BIO_AUTH_SUMMARY = _("Touch");
private const string BIO_AUTH_DETAIL = _("Touch the fingerprint reader");

You can imagine this being expanded for a Yubikey:

private const string BIO_AUTH_ICON = "drive-removable-media-usb";
private const string BIO_AUTH_SUMMARY = _("Insert Key");
private const string BIO_AUTH_DETAIL = _("Insert your authenticator key");

which would give you something like:

[cassidyjames]

For the case of multiple possible authentication methods, I'm not sure what we'd do. That's definitely something to think about.

[arshubham]

For the case of multiple possible authentication methods, I'm not sure what we'd do. That's definitely something to think about.

This was my query about. A device can have a muliple biometric authentication methods. I just wanted to point out that the dialog should me made in a future proof way preserving the choice of user. Great work by the way! 👏

[danirabbit]

I think we probably need to come up with something that is a bit more agnostic to the form of authentication. It is much simpler if we can only ask for one at a time, but I think because we have a lot more options than on mobile that we're going to find ourselves in a situation where we're trying to create a hierarchy of asking the user which auth method they want to use in a series of dialogs which would get annoying fast if the method you want to use changes depending on external conditions (my hands are wet or my spouse has my password; I left my auth key at work; My phone is not near me so I can't use bluetooth auth). I think in an ideal world I can set up a few different types of auth and then use whichever is more convenient at the time right away.

I wonder if we can just append additional language to the current auth dialog. Forgive my shitty mockup, but something like this:

[cassidyjames]

@danrabbit yeah, that direction could work. I liked the idea of a super simple dialog for the simple case, but maybe this is a better route.

[danirabbit]

Yeah I think in this way that the dialog would only be as complicated as the users' auth setup. If they didn't configure any of these additional auth methods, they'd only see what we have right now. But if they added something else, we would explicitly let them know they can use it here without making them jump through any hoops to get to a particular auth method

[cassidyjames]

@danrabbit my code mockup has been updated at https://github.com/cassidyjames/agents/blob/master/src/BiometricDialog.vala

[cassidyjames]

After a bit more iterating, we came to this:

1. Unique colors per authentication method. These would be used system-wide and could probably be defined in the system stylesheet for consistency.
2. A success state for "passive" authentication methods, like paired devices, already-connected USB keys, and probably facial recognition
3. Marking the password entry as insensitive if a passive method is successful, since we don't also need a password.

Code prototype updated at https://github.com/cassidyjames/agents/blob/master/src/BiometricDialog.vala

[arshubham]

@cassidyjames if a user uses passive authentication method, does he still needs to click Authenticate? A successful fingerprint scan should show us a little animation that it was successful, may be something on the lines of what is already done with system indicators like notification. Then it should automatically activate authenticate button.

[cassidyjames]

@arshubham precisely! Passive methods like a paired device, facial recognition, and an already-connected U2F key would count as passive. We'd want the user to still actively press authenticate in those cases. For active methods, like touching a fingerprint sensor or connecting a new U2F key, I think we can count those as active, show success, and press Authenticate for the user.

[neur0manc]

I'm really excited, that this is on the road map for eos - it would truly be a unique selling point to have an all-in-one solution baked into the base elementaryOS environment. There should be

• A user interface for registering fingerprints and also for managing existing finger prints
• Configuration for sudo, the permissions dialog (the one that pops up when installing packages via the app store), the login and the lock screen
• Drivers pre-installed for different hardware (these are hard to come by, apparently all newer hardware on ThinkPads have to be reverse engineered)

Is there any progress or internal talk about how to progress with this?