Security

Overview

HTID intercepts macOS authentication prompts (login screen, System Settings padlock and Keychain prompts) and satisfies them with a fingerprint swipe from a supported USB sensor, matched against locally stored templates.

Different sensors have real architectural differences. Some match on the host, others match on the chip and never expose raw image data, so read the per-backend notes below.

Not audited. It touches sensitive parts of macOS (authentication, sudoers, LaunchAgents, Keychain) and is a hobbyist open-source project, not audited by Apple or any third-party firm. Evaluate it accordingly.

Threat model

Intended use: convenience authentication on a personal Hackintosh you physically control.

It does NOT claim to

• Match Apple's Secure Enclave Touch ID. Hackintosh hardware has no Secure Enclave, and most backends match in userspace.
• Stop a skilled attacker with physical access and time, for example someone who dumps the encrypted volume and brute-forces the passphrase, or replaces the daemon binary.
• Defend against fake or molded fingerprints. None of the supported sensors do liveness detection.

Sensitive components

• Fingerprint templates live in the encrypted APFS volume HackTouchIDStore, with the passphrase in the System keychain. If your System keychain or FileVault is compromised, the volume is only as safe as that.
• The daemon runs with elevated privileges and uses a narrowly scoped sudoers NOPASSWD rule. Review it before installing. It should cover the daemon binary only. Keep the binary root-owned and not writable by your user.
• The prompt watcher is allow-listed to specific system processes. It is deliberately not wired to arbitrary third-party password fields or terminal sudo prompts.

Known issues and per-backend caveats

• Backend maturity varies. New sensor backends need real-hardware testing. Compiling cleanly is not the same as being hardware-verified.
• On-chip matching backends store no local image or raw minutiae. Off-chip backends store extracted minutiae templates locally, never raw images, but a template is still sensitive biometric data.
• Pairing is exclusive per host. On chips that support it, pairing a sensor to this Hackintosh can orphan, not delete, enrollments made under another OS on the same sensor. This is a hardware property, not a bug.
• Debug builds may log more. Development branches can include verbose diagnostics (key material, session state). Do not share that output publicly without reviewing it.

Supported versions

Please download the latest source before opening an issue. There are no tagged releases for security reasons. This is a spare-time project.

Reporting a vulnerability

Found a privilege escalation, sudoers misconfiguration, template or passphrase exposure, daemon impersonation, or similar? Please:

1. Open a GitHub Security Advisory (preferred), or
2. Open a GitHub Issue.

Include your macOS version and hardware, which sensor and backend is involved, the steps to reproduce, and the impact you believe it has. This is a solo-maintained project, so response times won't match a corporate bug bounty.

Recommendations for users

• Only build from this repo. Anything claiming to be HTID from elsewhere is most likely fake.
• Review the sudoers rule and LaunchAgent plist before installing. Don't run install scripts blindly.
• Treat it as a convenience layer on top of FileVault and a strong login password, never a replacement.
• Keep your templates private. Don't share your fingers/ directory or the HackTouchIDStore volume. They derive from your biometric print.

Disclaimer

Provided as-is, without warranty of any kind (see the license). Use at your own risk, especially on machines used for sensitive work.