Show HN: PanicLock – Close your MacBook lid disable TouchID –> password unlock

Hook this to a lid angle below 30° trigger in https://lowtechguys.com/crank and you can easily make it run on a simple lowering of the lid

You can have different fingers registered to different accounts. I used it to 'fast user switch' between accounts.

Or IMO easier: press the on/off button 5 or more times in rapid succession.

I wrote this after the case of a Washington Post reporter, Hannah Natanson, was compelled to unlock her computer with her fingerprint. This resulted in access to her Desktop Signal on her computer, revealing sources and their conversations.

https://www.yahoo.com/news/articles/washington-post-raid-pro...

Edit: I've a lot more details about the legality and precedence on the apps landing page https://paniclock.github.io/

I wonder if the US is the only place where this applies?

The UK, I believe, can compel you to provide passwords that you would be reasonably expected to know.

There's also the issue that the device is covered in fingerprints, and if you can build a clean image of the print, you can likely manufacture a gelatin copy of that fingerprint that will work on most fingerprint scanners.

I can't speak to the current generation of Apple fingerprint scanners, but historically iirc you can grab a print, clean it up in Photoshop, print it on OHP transparency using a laser printer and use it like a mould to copy a fingerprint.

The website has some more info on the biometric vs. password debate and legal situation:

https://paniclock.github.io/

While it's true that the legality of law enforcement forcing passwords in unclear, courts can absolutely force you to enter a password even if it's not written down by holding you in contempt indefinitely.

Take it to the logical end - you can tie up / handcuff / sedate / restrain an individual in order to get their fingerprint (or, ahem, way worse) but you cannot extract a password from someones brain.

> So just the normal TouchID mode but not for unlocking the mac.

Erm ? Just go to System Preferences and turn off "Use Touch ID to unlock your Mac" ??

I've thought the Apple platform has two glaring omissions

- touchid and biometric configuration profiles (standard, paranoid, extra paranoid)

- versioning for icloud backup

The simple fact is that there is no one-sized-fits-all use case for this.

Biometrics are great for the average user! They reduce shoulder surfing and increase security.

But for some users, you might want two factor for biometrics (such as an apple watch), or short windows before password entry is forced. You might want both biometrics AND password entry required. You might want to enable biometrics only when two factor is enabled.

Look, I'm not saying that what I've said is the ideal setup, by the way. Just that there is a lot of room for improvement versus the status quo.

At that point what you need is true multi-factor. For example, both fingerprint and per-device PIN.

Regrettably, that's not often offered as a feature, even when the infrastructure is already there.

Perfect rage quitting machine. There should be an enterprise version: when lid is closed with full force it also sends a professional resignation letter to the current employer.

You must not have cats or children if you think that last one is reasonable

My interpretation was that it's easier to physically force someone to mash their finger on the sensor than to get them to divulge a password, not that it offers you any kind of legal protection. But yeah, it's a plausible but somewhat contrived situation to find yourself in.

I'm reading this nervously on my MacBook Air, but chuckling quietly with my cheapest Mac Neo (my new travel companion).

Apple Silicon is at least much more difficult to attack in this way, though it might be possible.

a cop works for "the state," but he's definitely not a "state-level actor."

What do you mean by “the drive is still unencrypted”?

If your threat scenario includes somebody performing a DRAM freezing attack or similar, these are orders of magnitude harder to pull off successfully than to compel or bypass a biometric sensor, especially when the device is covered in the owners fingerprints.

> This does nothing since the drive is still unencrypted.

Even though the data is unencrypted in memory, an attacker would still need either a local privilege escalation (from the login window?), or some sort of side-channel attack if they're still not able to get the password.

Pressing and holding Power + Vol Up/Down is the current combo

This comment is based on one of my commits. The round-trip through Int is exactly what makes it safe.Int(value) will return nil (and be rejected) for anything that isn't a valid integer. no ; rm -rf /, no shell. String(seconds) on a Swift Int can only ever produce a decimal number. (which is probably overkill and not needed in this context.) > Please don't use slop machines to write READMEs. Trust me, they do a better job than I ever will.

Having said all that, it's probably something that could be dropped from the readme. I'll edit now.

edit: updated the readme. Thanks for taking the time to proof read it.

That's good feedback. I just added it to the readme:

> "PanicLock fills a gap macOS leaves open: there is no built-in way to instantly disable Touch ID when it matters. Biometrics are convenient day-to-day, and sometimes preferable when you need speed or want to avoid your password being observed. But in sensitive situations, law enforcement and border agents in many countries can compel a biometric unlock in ways they cannot with a password. PanicLock gives you a one-click menu bar button, a customizable hotkey, or an automatic lock-on-lid-close option that immediately disables Touch ID and locks your screen, restoring password-only protection without killing your session or shutting down."

I've more details on the apps landing page - paniclock.github.io

A person might use it to stop someone getting into your computer through certain types of physical coercion, forcing your finger to the reader, or (much less likely but I’m sure security services know how) a copy of your fingerprint.

But it isn’t a why, it is a what. That what is a tool that lets you quickly disable Touch ID for whatever reason you want to.

This still leaves your device in an AFU (after first unlock) state, with user data decrypted, and should not be treated as secure.

The only thing you can do (to protect your data from forensics, etc) is to return it to BFU by shutting it off.

Bringing up the shutdown screen (hold lock and either volume button) will also do it.

- TSA: Hey, bring your bag and devices here. Routine inspection.

- Traveler: [takes phone from the bin] [finds lock button] [click] [click] [click]

- TSA: Hey, stop what you're doing Mr. Terrorist!

On GrapheneOS (and maybe android generic?) this calls the emergency number, I just found out (with a 5 second timer to cancel this luckily)

If you're in a situation where this is a pressing issue, it's not a good solution as it's trivial to detect if it's a fake environment, especially if they get suspicious and run external forensics on it.

iirc the GrapheneOS team won't implement this feature for that reason

The middle finger could be the emergency use one ...

I think it’s about plausible deniability: you can pretend you’ve forgotten your password, you can’t pretend you’ve forgotten your finger.

Capable? Yes. Willing? I wouldn't be so sure. You don't even need to hurt someone to manhandle them enough to put their fingerprint on a scanner. Whereas forcing someone to give up a password could rise to the level of torture.

Of course, I imagine the majority of people would yield their password if you simply threatened to detain them long enough to make them miss their flight.