r/arduino • u/arduinoRPi4 • Aug 03 '26

Look what I made! Desktop Fingerprint Unlock

also made a video on this! https://www.youtube.com/watch?v=tB3lk-PNA6I

allows you to unlock your Mac via your fingerprint, as well as authenticate sudo and some TCC prompts (privacy&security).

the device emulates a PIV smart card and uses PAM to authenticate you in macOS (notice the password field says PIN and not password), so no plain text password is ever stored, exposed, or transmitted.

please be aware of the security implications (note that it is NOT touchID, but just 'fingerprint-based unlock', please do not think or refer to it as anything more secure):

this device is NOT secure, the authentication is all done inside the fingerprint sensor, and the fingerprint sensor just tells the microcontroller the match % (all low cost fingerprint sensors are this way, you would need to spend ~$50 to get one that does authenticated comms). the communication between the sensor and the microcontroller is not authenticated or protected, so anyone with physical access to both the device and your laptop can spoof this connection (pretend to be the fingerprint sensor) and give the go ahead to unlock your mac. you can make this extremely hard by filling the insides with black epoxy, but not impossible.

this is also the dev equiv of "rolling your own auth", the smart card implementation may have some errors, and should not be inherently treated as "unbreakable"

the device is made so that if you lose it, nothing of value can be extracted from it

use at your own risk. personally, i am comfortable using it at home where physical intrusion would be hard, but this depends on your own security tolerance. if you have high security instincts/requirements, the magic keyboard is a much much much better option in this regard.

there is also an HID version available, where the device just types your password emulating a keyboard, the benefit being it works in ALL places your password does. this version is obviously more insecure as it is vulnerable to keyloggers. the device still does not store the actual password, it stores an authentication key that sends a request to a service on the mac, which then sends it the encrypted password to be decrypted in RAM, typed back, and then wiped. again, depends on your personal security tolerance and willing to compromise

all code and materials are open source, licensed permissively github.com/zimengxiong/tinytouch

292 Upvotes

99% Upvoted

15 comments sorted by

18

u/A1pha-Wolf Aug 03 '26

I love your Totoro mat!

1

u/digitalBardo Aug 04 '26

it stole the show

1

u/arduinoRPi4 Aug 05 '26

not pictured but i also have a matching mousepad! so cute

2

u/sycln Aug 04 '26

This is pretty cool. I bought a second hand Magic Keyboard and salvaged the board and the Touch ID from there.

4

u/[deleted] Aug 03 '26

[removed] — view removed comment

4

u/quirky_planet Aug 04 '26

ofc u won't, it's a pc

1

u/benetheburrito Aug 04 '26

Wow I saw your YouTube video in my recommended

1

u/eracoon Aug 05 '26

I love that is goes in blender… nice

1

u/arduinoRPi4 Aug 05 '26

Thats plasticity!

1

u/eracoon Aug 06 '26

Oh ok. At first glance it looked like blender. Plasticity it is then 😁

1

u/Virtual-Diet-8777 Aug 09 '26

Amazing work i also built for a project a app focused smart lock with card linking options.

1

u/mohawk941 27d ago

Just received this in the mail today and it works very well. Was able to log in and use on safari passwords, and settings app.

1

u/arduinoRPi4 27d ago

Nice! Thanks for your support 🙂