upvote
I've thought the Apple platform has two glaring omissions

- touchid and biometric configuration profiles (standard, paranoid, extra paranoid)

- versioning for icloud backup

The simple fact is that there is no one-sized-fits-all use case for this.

Biometrics are great for the average user! They reduce shoulder surfing and increase security.

But for some users, you might want two factor for biometrics (such as an apple watch), or short windows before password entry is forced. You might want both biometrics AND password entry required. You might want to enable biometrics only when two factor is enabled.

Look, I'm not saying that what I've said is the ideal setup, by the way. Just that there is a lot of room for improvement versus the status quo.

reply
At that point what you need is true multi-factor. For example, both fingerprint and per-device PIN.

Regrettably, that's not often offered as a feature, even when the infrastructure is already there.

reply
Notably macOS cannot do this
reply
Careful with absolutist statements :)

macOS can in fact be configured to use a third party idp, including interactive elements, on loginwindow.

So, you could build your own through the ExtensibleSingleSignOn and Extensible Enterprise SSO macOS plugin API. You would do touchid, and then have it pop your own custom window/app, providing a prompt through that API, except it's just a hardcoded value (or some shit idk)

https://youtu.be/ph37Yd1vV-c

So yes, macOS can in fact do that. Just not out of the box. I strongly believe that it is a glaring omission, or at least something they should gate through lockdown mode. idk!

reply
If you create a piv certificate on a yubikey and just plug it in while logged in, it automatically registers it as a login method.
reply