a journal of interesting technical ideas . . .
by Brent Stewart on Sunday, May 1, 2022
My friend Jared recommended that I checkout Howdy, which is a PAM add-in to support authentication by facial recognition.
The first thing I did was install cheese so that I could make sure that my face was in the camera’s field of view. Next was installing Howdy.
sudo add-apt-repository ppa:boltgolt/howdysudo apt updatesudo apt install howdy
Howdy offfers three levels of certainty that a face is a match - Fast, Balanced, or Secure. I chose Fast each time. I’ve installed PAM modules (yes, I know that’s redundant) before and I remember it being a bit of a trick. In this case, the howdy installation takes care of all the details and you are (almost) ready to roll. I’ve installed Howdy on a few different machines and in both cases it said “Camera ID set” at the end of the install but neither worked. We’ll list the video devices as shown below.
root@pop-os:~# ls -ltr /dev/video*crw-rw----+ 1 root video 81, 1 Apr 29 20:11 /dev/video1crw-rw----+ 1 root video 81, 0 Apr 29 20:11 /dev/video0On the machines I’ve tested with, this reports multiple camera paths for each physical camera. I read at one point that these correspond to different camera modes, but that doesn’t match my testing here. On the machines I tested, I could use either camera path and it worked fine.
With that in mind, pick a camera path and type sudo howdy config (this edits the config file without having to use nano to find the path). Scroll down (for me it was about in the middle of the file) and replace the existing device_path variable as shown.
# The path of the device to capture frames from# Should be set automatically by an installer if your distro has onedevice_path = /dev/video0Almost there. At this point, your camera should work but you need to train the system on your face. To do that, use sudo howdy add. Look into the camera - you’ll see it come on and take a picure.
root@pop-os:~# sudo howdy addNo face model folder found, creating oneAdding face model for the user brentEnter a label for this new model [Initial model] (max 24 characters): Brent
To confirm its working, open a new termainal and escalate to root (sudo -i). If it works, the camera will come on and then you will be authenticated. Howdy works for authentication into the GUI and for sudo or wherever you need to authenticate. I tested authentication for initial login and for sudo.
I installed this on a laptop one night and enrolled with the light on beside me. Later, the light was off and it wouldn’t authenticate until I turned the light back on. The Howdy algorithm is somewhat sensative to lighting conditions, but I didn’t make a study of exactly how far I could push this. It’s worth mentioning that Howdy supplements existing authentication, so if your face isn’t detected after a few seconds it rolls back to the traditional password prompt.
Just for fun, I tried to fool Howdy. It was able to correctly deny access to my wife and my youngest son. William and I look similar, so I thought that might work. William then tried to make himself look like me - smiling and even putting on glasses. Howdy worked perfectly for these casual bypass attempts. I also tried using my driver’s license, but Howdy denied this as well (it says it’s using IR, so I didn’t expect that to work).
This was a lot of fun to setup and test. I was initially wary about locking myself out, but never really felt like that was a danger. For casual home use, this seems like a pretty cool idea. I’m going to be a little more conservative on my work laptop. It’s exposed to more potentially serious and malicious people at the office and at Starbucks.
