Is this laptop at home?
Checking if I’m home for face auth
My laptop doesn’t have an IR camera, or a fingerprint reader. This is a slight issue, since I get lazy typing out my password for every sudo request. Weakening my password is generally considered a very bad idea, but I did still want a slightly faster way to log in.
Howdy is probably the most well known way to get fast face authentication in Linux, and it works without an IR camera. However, that does mean security is quite compromised. Someone could just hold up a photo and presumably my laptop unlocks. Doesn’t seem like the best of ideas.
Added by proofreading Claude Opus 5
Howdy’s own README agrees with Asuwa here, in about as many words: “a person who looks similar to you, or a well-printed photo of you could be enough to do it”, followed by “DO NOT USE HOWDY AS THE SOLE AUTHENTICATION METHOD FOR YOUR SYSTEM” in capitals. It’s a stated design position rather than a bug — the project calls itself a quicker way of logging in, not a more secure one.
I then happened to stumble upon BioPass, which seemed to be tackling the exact issue with ML powered liveness detection. It’s a much smaller project, and the liveness detection is possibly somewhat of a best effort, but it’s better than nothing!
Still, I might want just one more assurance that the laptop is in a reasonably secure position before allowing this camera based authentication for sudo. That’s where the Pi on my network comes in!
I have a small Raspberry Pi Zero 2 W on my LAN with an explicitly assigned IP. If I check its SSH signature SSH host key fingerprint at the internal assigned IP, I can be somewhat sure my laptop is sitting at home. (Corrected by proofreading Claude Opus 5 — Asuwa wrote “signature”. A signature proves someone holds a private key for a message; a host key fingerprint is just a hash of the server’s public key, which is the thing actually being compared here.) I did decide that signal plus my face generally looking real and correct was enough of a signal for my personal laptop.
Of course, Claude Code helped me set this up, so:
How the location check actually gates sudo
Added by Claude Opus 5, at Asuwa’s invitation
Asuwa asked me to explain the shape of this without publishing the details that would identify where “home” is, so what follows is deliberately generic — no addresses, no fingerprints, no network identifiers.
The location check does not run when Asuwa types sudo. It runs on a timer, every thirty seconds, and all it does is create or delete a small flag file. Authentication then reads the flag file, which is a single filesystem check rather than a network round trip. That ordering matters more than it looks: if the probe ran at authentication time, every sudo would sit and wait on the network, and a slow or unreachable target would turn a lock screen into a hang. The cost of doing it this way is that the signal can be up to half a minute stale.
The gate itself is one line in the PAM stack, sitting above the face module. PAM lets a module’s exit status decide how many of the following lines to skip, so a failed location check jumps straight over face authentication and lands on the ordinary password prompt. A passed one leaves the face module in place, and because that module is marked sufficient, a successful face match ends authentication then and there. Nothing is ever unlocked by location — the strongest thing a failed check can do is take the fast path away.
The part I’d keep an eye on is the other direction. The flag only changes when the timer runs, so a timer that stops leaves the last answer sitting there, and if the last answer was “yes” it stays “yes”. Two things keep that small: the flag lives in a directory the system wipes on every boot, so a stale yes can’t survive a shutdown, and the timer picks straight back up on wake — the window is the half minute after a suspended laptop opens somewhere new.
One last thing, since the title of this post slightly oversells it: there’s more than one place marked trusted, each with its own flag. “Is this laptop at home” is really “is this laptop somewhere Asuwa said counts”.
By the way, this also has the side effect of allowing Claude Code to sudo on my behalf! Usually, Claude uses a noninteractive terminal, and it fails to run administrative commands. Giving it my password in plaintext is likely not considered the best of ideas. Having BioPass set up means Claude can now sudo as long as I’m watching, in a very literal sense.