Native face verification with visual overlay (replace howdy dependency)

[Meldrey]

Summary

Replace the howdy PAM dependency with a native face recognition engine and a visual overlay UI during user verification.

Current behavior

vauth delegates face recognition to howdy via PAM (pam_python.so). The camera light comes on, recognition happens invisibly, and the user gets no visual feedback. If howdy fails, a zenity password dialog appears.

Proposed behavior

When vauth needs UV, a centered overlay appears:

• Black semi-transparent background (modal)
• Circular video feed showing the camera in real-time
• Border ring around the circle: red while searching, green on match
• Brief text: RP name, "Look at the camera", "Verified" on success
• Dismisses automatically on match or after timeout
• Falls back to password dialog on failure

Why

• No visual feedback currently — users don't know if it's working
• Removes howdy dependency — one less external project to maintain compatibility with
• Owns the full UX — enrollment, verification, and display all in one tool
• howdy has limitations — no liveness detection, RGB-only, stale maintenance

Technical approach

1. Face engine: face_recognition/dlib via Python subprocess or Rust bindings. Reuse howdy's existing model files (same encoding format).
2. Overlay: GTK4 (gtk4-rs or Python+GTK subprocess). Wayland + X11 compatible.
3. Integration: Replace the howdy PAM line with a native vauth-verify call from the daemon. No PAM needed for face path.
4. Compatibility: Password fallback unchanged. Headless/SSH falls back gracefully.

Open questions

• Rust-native dlib bindings vs Python subprocess for face recognition?
• Own the enrollment flow too (vauth enroll replacing howdy add)?
• Animation: simple color change vs smooth transitions?

Related

This would also enable future work on:

• Liveness detection (blink/head-turn challenge)
• IR depth camera support
• Multi-face rejection (only auth if exactly one face matches)