Skip to content

fix: replace go-touchid to support fallback when biometrics are not available#69

Merged
mbevc1 merged 2 commits intoByteNess:mainfrom
noamcohen97:device-owner-authentication
Feb 18, 2026
Merged

fix: replace go-touchid to support fallback when biometrics are not available#69
mbevc1 merged 2 commits intoByteNess:mainfrom
noamcohen97:device-owner-authentication

Conversation

@noamcohen97
Copy link

@noamcohen97 noamcohen97 commented Feb 18, 2026

Summary

Replace github.com/lox/go-touchid with github.com/noamcohen97/touchid-go to fix authentication failures
when Touch ID is unavailable (e.g. MacBook lid closed, biometrics not enrolled).

Issues in current library

The old library (lox/go-touchid) has several issues:

  1. Hardcoded biometrics-only policy - It uses LAPolicyDeviceOwnerAuthenticationWithBiometrics,
    which requires biometric hardware to be available and enrolled. When Touch ID is unavailable (e.g. screenclosed, no biometric sensor), canEvaluatePolicy returns false and the library provides no fallback.
  2. Hangs when biometrics are unavailable - When canEvaluatePolicy returns false, the code skips the
    evaluatePolicy call
    but still calls
    dispatch_semaphore_wait, which blocks forever since no one signals the semaphore.

The new library (noamcohen97/touchid-go) avoids all of the above - it properly manages LAContext lifecycle, returns early on canEvaluatePolicy failure, and lets the caller configure the LAPolicy.
This PR uses DeviceOwnerAuthentication to allow the system to fall back to the device passcode/password when biometrics are unavailable. Just like advised in the Apple documentation:

To let the system handle the fallback option by asking for the device passcode (in iOS or watchOS) or the user’s password (in macOS), use the LAPolicy.deviceOwnerAuthentication policy instead.

@mbevc1
Copy link

mbevc1 commented Feb 18, 2026

Thanks, are you maintaining that library @noamcohen97? Looks like it's not a fork, but improved implementation.

@noamcohen97
Copy link
Author

Yes! I wrote it because I couldn't find any library that is context-aware, supports multiple policies, and parses error codes.

@mbevc1 mbevc1 merged commit 8427dcc into ByteNess:main Feb 18, 2026
4 checks passed
@noamcohen97
Copy link
Author

Thanks for reviewing @mbevc1 !

@noamcohen97 noamcohen97 deleted the device-owner-authentication branch February 18, 2026 15:46
@mbevc1
Copy link

mbevc1 commented Feb 18, 2026

Hey, @noamcohen97 have you tried compiling for Darwin Arm? Seems Homebrew is hitting this one: https://github.com/Homebrew/homebrew-core/actions/runs/22149824417/job/64038209199?pr=268190#step:3:127

@noamcohen97
Copy link
Author

noamcohen97 commented Feb 18, 2026

In this case, it's the older macOS version that is causing the compilation failure. I just released v0.3.0 that should address this compatibility issue.
Sorry about that
I created #70 to address it, I'm not sure how long it will take for dependabot to catch up

@mbevc1
Copy link

mbevc1 commented Feb 19, 2026

Thanks, merging now!

@noamcohen97
Copy link
Author

I will bump Homebrew formula as son as fixed version of aws-vault will be released.
Again - sorry about that

@mbevc1
Copy link

mbevc1 commented Feb 19, 2026

No worries @noamcohen97 and thanks for a quick response. homebrew should be picking it up shortly

@noamcohen97
Copy link
Author

I figured that the patch must be removed

@mbevc1
Copy link

mbevc1 commented Feb 19, 2026

Yes, we should remove that now

@noamcohen97
Copy link
Author

Done!
Homebrew/homebrew-core#268311

@mbevc1
Copy link

mbevc1 commented Feb 19, 2026

Awesome, great stuff! ⭐

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants