Howdy: Allow normal password entry at the same time as face recognition

[boltgolt]

As suggested by @magarto, make Howdy asynchronous so a password can be entered at the same time though the default Unix way. This has to be done with the PAM, not sure how.

[boltgolt]

I've found a doc from the fingerprint-gui module that explains how they got this principle to work.

[magarto]

If I unterstand well from case 4, typing password should stop face_detection module (if not other modules are working).

Case 4 (user has typed the password)
If the PAM module returns from its password prompt with a non empty password field the user has typed his password at the prompt. Then the module sends SIGUSR2 to the helper to stop it immediately and returns PAM_IGNORE. So the other PAM modules can check the given username/password.

[boltgolt]

That's what I tried to do in python, but I ran into 2 issues:

First of all, the call to the PAM conversation is interpreter-blocking. This means that when we promt for a password nothing else can run. Even separate threads will freeze.

Secondly, I can't get the PAM_IGNORE signal to pass the captured password to the other PAM modules. It's doing the exact same thing as fingerprint-gui (I've run though the source) but it just falls through to a second password prompt.

[RussianNeuroMancer]

@boltgolt did you tried contact linux-pam developers about this issue?

[boltgolt]

I haven't, and looking at the issues page of the project it doesn't seem very active. I was working on removing the dependency in it's entirety and writing the PAM part in C++. However, i'm not that comfortable in C++ so that's on hold for now.

[RussianNeuroMancer]

it doesn't seem very active

Indeed: https://sourceforge.net/p/pam-python/code/ci/19f932b71918cbcd639a26bef79e2de0c3d9d5c4/log/?path=

Maybe try this one?

https://github.com/minrk/pamela

[dmig]

sourceforge project seems dead, but here is some activity: https://github.com/Ralnoc/pam-python

[papermache]

Enabling password entry at the same time as face recognition is becoming mandatory as authentication is not a priority of security rather an issue of urgency. If I really need access I can't wait for the camera to detect me. It's a make or break feature.

[icorbrey]

@boltgolt With your hesitation to use C++ maybe we could try using a different low-end language? There are several alternatives that would perform just as fast (if not faster) than plain old C++ (specifically Rust and Go come to mind).