[inickt]

Does watch unlock now work natively with pam_tid? I know as of at least a few months ago it would only work if you could use touch ID, i.e. when the laptop was open. If it was docked, it would fall back to password auth.

I wrote a patcher that changed this behavior, it patched pam_tid directly on your system and just updates the API Apple calls to allow unlocking with watch-only when touch ID is unavailable:

https://github.com/inickt/pam_wtid

Was a fun reverse engineering experience and wrote up some more info in the README.

[apetrovic]

I'm using this to authorize sudo (and other things) with Apple Watch:

https://github.com/insidegui/pam-watchid

... and my /etc/pam.d/sudo needs to be changed like this:

    # sudo: auth account password session
    auth       sufficient     pam_watchid.so
    (...)

This needs to be applied after every system update. Apart of that, it works really well (I have very dry skin so touch ID works for me 50% on a good day)

[inickt]

Guilherme’s stuff is great. pam-watchid is a reimplementation of Apple’s pam_touchid, but uses the other authentication flag which I patch in to the original binary.