This package is in no way as secure as a password and will never be. Although it's harder to fool than normal face recognition, a person who looks similar to you, or a well-printed photo of you could be enough to do it. Howdy is a more quick and convenient way of logging in, not a more secure one.
To minimize the chance of this program being compromised, it's recommended to leave Howdy in /lib/security and to keep it read-only.
DO NOT USE HOWDY AS THE SOLE AUTHENTICATION METHOD FOR YOUR SYSTEM."
(Unless you'd argue that the face unlock found on Pixels is not passable either)
Doesn't that mean that any camera can be used to infer phase (and thus depth for face ID, which is a high risk application)?
> variable focus
A light field camera (with "infinite" focus) would also work.
I did have fun opening the IR camera feed and seeing objects of various opacity in visible spectrum behaving differently in IR.
You can also enable "rubberstamps" which require an action from you like nodding yes to confirm authentication and making it harder to fool. As noted in the readme though, Howdy is never going to be 100% secure
Also this only handles user authentication unlike on Windows where it can be usedpasskey. disk encryption and for passkeys.
Edit: This program also saves the landmarks of your face into a file in plain text when it gets added.
That said, without the depth reconstruction, I do agree that this is nowhere close to Windows Hello's features. That's not the devs' fault (that kind of mostly-secure facial recognition is very hard) but I also don't think the comparison is apt. But who knows, if this project gains popularity, maybe in the future that kind of thing becomes possible.
This is more akin to Android's facial recognition, except for using the IR camera. Which is still acceptable for plenty of people. After all, many fingerprint readers on Linux share similar risks and are often regarded as secure enough. I think the availability of this project, even if it's nowhere near Windows Hello's standards, is a great addition to many Linux desktops, as long as their users understand the limitations.
As for the plaintext, Linux doesn't really have a secure storage mechanism (even the standard secrets API is easy to fool) so obfuscating the facial features doesn't really serve a purpose. As long as your disk is encrypted, I don't think that's a risk (and if it isn't, whoever is looking at your laptop can just browse through your photo albums anyway).
none are perfect but they allow users to easily access their devices without having to remember and type in huge passwords.
It wasn't strictly plug and play, but it only took like 20 minutes of fiddling.
Actually even the Fedora package's specfile only says Python 3, so I'm not sure why the README says that it still needs Python 2.
Edit: Okay, the explanation is in this commit message: https://github.com/boltgolt/howdy/commit/305e42fc79ef38f66c5... . The dep on Python 2 is from Fedora's PAM module package, not from howdy itself. On OpenSUSE the corresponding PAM module package depends on Python 3 already.