Let me use biometrics (Howdy, fprintd, etc.) instead of the fake "notification UV" or PIN

[AuthenticSm1les]

Problem

Currently, passless only supports user verification via:

1. Desktop notification (click-to-accept)
2. PIN (set via passless client pin set)

For a more seamless experience, it would be desirable to allow biometric user verification using existing Linux authentication mechanisms.

Proposed Solution

Add a configurable user verification method that delegates to an external mechanism (e.g., PAM, or a user-specified command) for biometric verification. This would allow integration with tools like Howdy (facial recognition via IR camera), fprintd (fingerprint), or any custom biometric solution.

Architecture

The request_uv() callback in cmd/passless/src/authenticator.rs (lines 132-173) is the single hook point where UV decisions are made. Currently it either returns UvResult::Denied (forcing PIN) or shows a notification (UvResult::AcceptedWithUp). A third path could be added:

1. PAM integration (via pam crate): Open a PAM transaction with a service that chains to pam_howdy.so (or other PAM biometric modules), call pam_authenticate(), and return UvResult::AcceptedWithUp on success.

2. External command hook (simpler): A config option like uv.external_command = "/path/to/biometric-check" -- passless runs the script; exit 0 = accepted, non-zero = denied.

Configuration Example

[uv]
method = "external"
external_command = "/usr/local/bin/passless-uv-howdy"
timeout_seconds = 30

Or for PAM:

[uv]
method = "pam"
pam_service = "passless-uv"

Challenges

• PAM may need a session/TTY since passless runs as a user service
• Camera device permissions for Howdy
• Need a timeout + fallback if biometrics are unavailable
• Should respect existing pin.enforcement behavior as fallback

Related

• soft-fido2 already supports the bioEnroll option -- could potentially be wired up
• The PinStorageCallbacks pattern in passless shows the adapter architecture is well-suited for this type of extension

Would you be open to a PR implementing this?

[pando85]

Hello there,

Thanks for opening the issue. We have a PR that implements biometrics (#198) but it is not tested because I don't have time for this currently.