Aws-vault: Support TouchID

[ejholmes]

Recent versions of Macbooks include the touch bar, which has TouchID + Secure Enclave. It would be nice if aws-vault supported using biometrics through TouchID, instead of passwords when accessing the keychain.

I believe this would depend on support within keybase/go-keychain first.

[FernandoMiguel]

+1

[lox]

Kind of like https://github.com/99designs/aws-vault/pull/131 and https://github.com/lox/go-touchid?

[lox]

The go-keychain folks weren't keen on it https://github.com/keybase/go-keychain/issues/11

[lox]

I actually had #131 in a usable state for quite some time, wouldn't be hard to resurrect, would love some feedback on it.

[ejholmes]

That seems pretty close to what I'd want for this. This is my own lack of experience with OSX/iOS API's, but it seems like the implementation in https://github.com/99designs/aws-vault/pull/131 doesn't actually tie access to the keychain item to biometrics; the biometrics check is done in Go, rather than setting the access control settings on the keychain item. Would it be better to do something like what's mentioned in https://developer.apple.com/documentation/localauthentication/accessing_keychain_items_with_face_id_or_touch_id?language=objc, so that biometrics are checked by the keychain API's?

[lox]

Neat, I dimmly recall that I couldn't make that work when I tried a year or so ago, but agree that is a much better way to do it if viable. Will give it a go.

[lox]

I had a go at it. The issue is that go-keychain is using the old Access API's, and the TouchID stuff lives in the new AccessControl API's. I think it's beyond my Objective-C abilities to reconcile the two in a way that can be upstreamed. If someone with some Objective-C skills wanted to advise, I'll help with the golang side of things.

[ejholmes]

Farther than I got! Thanks for trying.

[eni9889]

Any interest in reviving this? I'd be willing to help with obj-c/cpp side of things.

[StevenACoffman]

@eni9889 Check out https://github.com/lox/go-touchid and see if you can make any headway on that side. The golang side we got.

[lox]

I would LOVE help on this, if someone with obj-c skills wanted to help I'd be super responsive on getting it merged.

[rafilkmp3]

+1

[lox]

+1's won't help, need someone with some objective-c skills I'm afraid.

[geoffreywiseman]

What needs help on go-touchid? I know you said Obj-C skills, but ... more details would be useful. It's been a while since I last touched Obj-C, but I'm curious at least. I poked around on the project briefly but I didn't see any issues filed describing where the hangups are.

[nickatsegment]

@lox I'm interesting in getting this in aws-okta and I might have an Objective C buddy we can lean on. Can we see the code you wrote as far as you got?

Also, I opened this https://github.com/keybase/go-keychain/issues/61

[jdolitsky]

Hello, the code found here may be useful: https://github.com/infinum/Locker

Features

• Save data in Keychain.
• Fetch data from Keychain with Biometric ID.
• Delete data from Keychain.

[FernandoMiguel]

i'm curious to know if there was any progress on this, so we can unlock the keychain with touchid instead password

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[moltar]

Not stale