[Investigate] Look into similar BT Unlock OpenSource Projects

[zakuArbor]

Purpose

There are a few different projects similar to this one and are stable. It would be interesting to take a look at what they are doing and compare our approaches to see what is the best way to approach this problem

Tasks/Goals

• Bluetooth-Unlock
• BLE-Unlock

Summary

To fill out once the issue is to be closed. Give a short summary of the changes you made to implement or fix an issue

[zakuArbor]

Bluetooth-Unlock

In case the original author reads this, I like the simplicity of your implementation and my commentary is based on my very quick glance so please do correct me.

Repo: https://github.com/LethalEthan/Bluetooth-Unlock
commit: 9c14e571903b04a77c3fa897c485e14febf99041
Language: Python
target: Linux with any Bluetooth capable device
Description: Bluetooth unlock is a python script that checks for your device periodically to check if you are there, and if no connection is found then your computer locks
Notes:

• supports various desktop environments (i.e. GNOME, KDE, MATE, etc)
• uses l2ping - Send L2CAP echo request and receive answer
  • see more in https://linux.die.net/man/1/l2ping
• essentially it pings the trusted device (only one device) and if it receives and ok signal, it unlocks the desktop. Else it'll lock the device.
• requires the user to login initially to start the program
• user device is either listed in config.ini or user inputs the mac address

Comments: I really like the simplicity of this project. It essentially does what ProxyAuth does but with way less complexity and ease of use. It's essentially a program that runs when the machine is unlocked and it flips between lock or unlock state without using DBUS. There are a few limitations to this implementation which I will address below. If someone wants to have a simple Bluetooth login for their own personal use that is simple then this is the project you will want to look into. This is ideal for those who are in their own rooms and want to quickly access their machine without their family members or friends being able to pry into it when they are not around.

Limitations: Due to its simplicity, it's not ideal in a security perspective and does have edge cases that will probably make the program fail (I didn't take a deep look and didn't test it so I could be wrong which is likely since I glanced the code for less than 5 mins. That's the beauty of this implementation, so simple and it works). I am also a bit confused about the tabbing logic because in Python it looks like it shouldn't work (I haven't manually ran it nor look at the file in raw) and I did take a very quick glance at it (this is why I hate Python tabbing no bracket)

• It authenticates based on the ability to ping
  • this is what our first approach was except we did a terrible idea of trying to scan when we should have just pinged it (much faster)
  • problem is that it's not secured from spoofing (neither is ProxyAuth)
  • it requires the user to ensure the permissions set to the config file is correct (i.e. trusts that a link attack and improper permission setting of the file won't occur)
  • not ideal for lab settings where you may be nearby the machine but talking with someone else (i.e. computer is out of view)
• Edge Case 1: suffers the same issue the proxyAuth had whereby a user could unlock the machine manually and will mess up the state of the variable that keeps track whether the machine is unlocked
  • if the user manually locks the machine and leaves their phone then they cannot login back via Bluetooth because the state (i.e. mode) will be in unlock state even though it's actually locked
  • (extremely unlikely and contrived example) if user manually unlocks machine (state is still in lock state) and someone snatches their phone so the user runs off trying to catch the person, the desktop will not auto-lock
    • I will like to emphasize this is an extremely unlikely scenario and outside of the use case of the project

Overall:

• simple and extremely convenient with install script that does everything for you
• not ideal in open settings and not very secure

to update

---

Side Note

I definitely know that the proxyAuth group would have been much happier and more cooperative if we have done something like this. Sorry to ___ for saying Python was not a valid option (well I did say it was possible but not the best idea and it wasn't something PAM normally supports). If we did not work on a PAM, then Python would have been a perfectly viable option.