aws-vault
aws-vault copied to clipboard
99designs
Support TouchID
Recent versions of Macbooks include the touch bar, which has TouchID + Secure Enclave. It would be nice if aws-vault supported using biometrics through TouchID, instead of passwords when accessing the keychain.
I believe this would depend on support within keybase/go-keychain first.
Kind of like https://github.com/99designs/aws-vault/pull/131 and https://github.com/lox/go-touchid?
The go-keychain folks weren't keen on it https://github.com/keybase/go-keychain/issues/11
I actually had #131 in a usable state for quite some time, wouldn't be hard to resurrect, would love some feedback on it.
That seems pretty close to what I'd want for this. This is my own lack of experience with OSX/iOS API's, but it seems like the implementation in https://github.com/99designs/aws-vault/pull/131 doesn't actually tie access to the keychain item to biometrics; the biometrics check is done in Go, rather than setting the access control settings on the keychain item. Would it be better to do something like what's mentioned in https://developer.apple.com/documentation/localauthentication/accessing_keychain_items_with_face_id_or_touch_id?language=objc, so that biometrics are checked by the keychain API's?
Neat, I dimmly recall that I couldn't make that work when I tried a year or so ago, but agree that is a much better way to do it if viable. Will give it a go.
I had a go at it. The issue is that go-keychain is using the old Access API's, and the TouchID stuff lives in the new AccessControl API's. I think it's beyond my Objective-C abilities to reconcile the two in a way that can be upstreamed. If someone with some Objective-C skills wanted to advise, I'll help with the golang side of things.
Any interest in reviving this? I'd be willing to help with obj-c/cpp side of things.
@eni9889 Check out https://github.com/lox/go-touchid and see if you can make any headway on that side. The golang side we got.
I would LOVE help on this, if someone with obj-c skills wanted to help I'd be super responsive on getting it merged.
What needs help on go-touchid? I know you said Obj-C skills, but ... more details would be useful. It's been a while since I last touched Obj-C, but I'm curious at least. I poked around on the project briefly but I didn't see any issues filed describing where the hangups are.
@lox I'm interesting in getting this in aws-okta and I might have an Objective C buddy we can lean on. Can we see the code you wrote as far as you got?
Also, I opened this https://github.com/keybase/go-keychain/issues/61
Hello, the code found here may be useful: https://github.com/infinum/Locker
Features
- Save data in Keychain.
- Fetch data from Keychain with Biometric ID.
- Delete data from Keychain.
i'm curious to know if there was any progress on this, so we can unlock the keychain with touchid instead password
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
![stale[bot] avatar](https://avatars.githubusercontent.com/in/1724?v=4 "Published by a pub.dev verified publisher"){kind=small}
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
Seems what's challenging is that:
- aws-vault depends on
github.com/99designs/keyringto access the OS keyring in an OS-independent way -
github.com/99designs/keyringdepends ongithub.com/99designs/go-keychainto access the Mac OS keychain -
github.com/99designs/go-keychainis itself a fork ofgithub.com/keybase/go-keychain - the Keybase folks have an issue open (https://github.com/keybase/go-keychain/issues/61), but in the past also considered it and implemented it as a separate package (go-touchid) which isn't applicable to what we want to achieve here
So it seems there are two options:
- Implement this feature in
github.com/99designs/go-keychain, but have it diverge from upstream - Talk with Keybase folks and implement this feature in
github.com/keybase/go-keychain
In any case, it does require some Go/Objective-C bindings (probably in keychain.go) to allow specifying a non-default LAContext, through the kSecUseAuthenticationContext when calling SecAddItem
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
