Hook this to a lid angle below 30° trigger in https://lowtechguys.com/crank and you can easily make it run on a simple lowering of the lid
Wowfunhappy 2 hours ago [-]
At that point, why not just disable Touch ID?
hervature 1 hours ago [-]
When the bad guys are too impatient to wait until you leave the computer but not fast enough to stop you before 30 degrees while keeping the convenience of life.
mrdomino- 7 hours ago [-]
Neat idea.
I remember way back in the day, there was some question as to the legality of compelled unlocking of devices; IIRC, it’s been deemed legal to compel a fingerprint, but illegal (under the first amendment?) to compel entry of a password—IIRC, as long as that password hasn’t been written down anywhere.
I gather this is written to that end primarily? Or is there some other goal as well?
seanieb 7 hours ago [-]
I wrote this after the case of a Washington Post reporter, Hannah Natanson, was compelled to unlock her computer with her fingerprint. This resulted in access to her Desktop Signal on her computer, revealing sources and their conversations.
Edit: I've a lot more details about the legality and precedence on the apps landing page https://paniclock.github.io/
dang 49 minutes ago [-]
(I've put a copy of this text at the top of the thread, since it's standard for Show HNs to have some intro/background up there. I hope that's ok with you!)
seanieb 42 minutes ago [-]
Thank you!
mrdomino- 6 hours ago [-]
Cool, thank you.
Nexxxeh 15 minutes ago [-]
There's also the issue that the device is covered in fingerprints, and if you can build a clean image of the print, you can likely manufacture a gelatin copy of that fingerprint that will work on most fingerprint scanners.
I can't speak to the current generation of Apple fingerprint scanners, but historically iirc you can grab a print, clean it up in Photoshop, print it on OHP transparency using a laser printer and use it like a mould to copy a fingerprint.
420official 5 hours ago [-]
While it's true that the legality of law enforcement forcing passwords in unclear, courts can absolutely force you to enter a password even if it's not written down by holding you in contempt indefinitely.
xoa 4 hours ago [-]
>courts can absolutely force you to enter a password even if it's not written down by holding you in contempt indefinitely.
This is not true outside of a narrow exception. Indeed this is the core point of the 5th Amendment, to protect you from having to be witness against yourself. It's just as binding on the judicial branch as it is on the executive. Ordinarily, a court may not compel a defendant to testify or say something that could incriminate them.
The narrow exception is the "foregone conclusion doctrine", which allows compelling testimony about specific evidence the government legally knows exists, knows the defendant controls access to, and knows is authentic. All of which has a bunch of caselaw around it. The textbook example is somebody has a device open, and an officer directly witnesses illegal material on it, but before they can seize it the person manages to turn it off and now it cannot be accessed without a password. So the government can say "we witnessed this specific illegal material, and this device is owned by the defendant and we can prove from video that they have accessed the device, and we want access to that specific material". But if you're just crossing the border with a locked device, they cannot compel the password just to search through it, or even if they're suspicious of something specific. They need actual knowledge, either through their own evidence or because the person foolishly talks and confesses something.
Otherwise they can definitely physically seize the device for a time (which could be very inconvenient/expensive depending) but that's it.
xoxxala 7 hours ago [-]
The website has some more info on the biometric vs. password debate and legal situation:
Take it to the logical end - you can tie up / handcuff / sedate / restrain an individual in order to get their fingerprint (or, ahem, way worse) but you cannot extract a password from someones brain.
If it's in scope to "way worse" someone to get their fingerprint, I'm sure I can be very persuasive in getting their passwords.
whalesalad 3 hours ago [-]
You can get the fingerprint of a dead person... you cannot extract a password from a dead person.
stavros 3 hours ago [-]
Of course not. You extract it right before.
freehorse 5 hours ago [-]
This is great. I see many times "security advice" against biometrics replacing password unlock, but most of the time I am more worried about getting recorded by somebody/something while typing a password in the open than anything else. This makes it better for those other cases.
surround 2 hours ago [-]
> in sensitive situations, law enforcement and border agents in many countries can compel a biometric unlock in ways they cannot with a password.
If the threat model includes state-level actors, then disabling biometrics won't prevent data from being retrieved from physical memory. It would probably be wiser to enable disk encryption and have a panic button that powers down/hibernates the computer so that no unencrypted data remains on RAM.
The website says shutdown "takes time" and "kills your session" but a hibernation button would take effect just as fast and would preserve the session.
LoganDark 2 hours ago [-]
Apple Silicon is at least much more difficult to attack in this way, though it might be possible.
jovial_cavalier 2 hours ago [-]
a cop works for "the state," but he's definitely not a "state-level actor."
surround 2 hours ago [-]
How do you define "state-level actor?" Police departments certainly have access to state and federal forensic resources to access unencrypted data in memory.
stackghost 1 hours ago [-]
In the context of breaking into phones and laptops, "state-level actor" usually implies a team of people with NSA-type forensic capabilities. That is, they have deep expertise in infosec and related topics, access to 0days that the security apparatus has hoarded and kept secret for their own use, and they may have bespoke hardware to facilitate attacking the device.
A random cop might have access to a Cellebrite machine but they can't just call up the NSA and ask them to break into some drug dealer's macbook.
surround 10 minutes ago [-]
Fair enough. Though they certainly could still break in if the laptop isn't encrypted, so this tool is only useful when combined with disk encryption.
gruturo 3 hours ago [-]
This would be perfect if it could monitor the force with which the lid is closed (macs have accelerometers after all, either this info or an acceptable proxy could be derived?).
Gently close? no action.
Stronger, faster action? Disable touch ID
Slam shut in full panic? yeah disable all biometrics, lose all state, even wipe the ram and the filevault key if it's an option
thih9 3 hours ago [-]
Perfect rage quitting machine. There should be an enterprise version: when lid is closed with full force it also sends a professional resignation letter to the current employer.
QuercusMax 3 hours ago [-]
You must not have cats or children if you think that last one is reasonable
gruturo 3 hours ago [-]
Ok just unload the filevault key from ram, better? And if possible tell the secure enclave to revert to the before-first-unlock state
wolvoleo 3 hours ago [-]
I'm surprised Apple doesn't offer an option. On the iPhone you could do this by pressing the power button several times. Not sure if this still works because the iPhone 6 was my last one though.
bhj 3 hours ago [-]
Pressing and holding Power + Vol Up/Down is the current combo
dozerly 10 minutes ago [-]
Pressing the power button 5 times fast also does it!
rglover 3 hours ago [-]
This is awesome, thank you. Was just thinking about this problem the other day. Glad someone whipped something up.
p0w3n3d 6 hours ago [-]
What's the rationale? It should be described in the README.md IMO
seanieb 6 hours ago [-]
That's good feedback. I just added it to the readme:
> "PanicLock fills a gap macOS leaves open: there is no built-in way to instantly disable Touch ID when it matters. Biometrics are convenient day-to-day, and sometimes preferable when you need speed or want to avoid your password being observed. But in sensitive situations, law enforcement and border agents in many countries can compel a biometric unlock in ways they cannot with a password. PanicLock gives you a one-click menu bar button, a customizable hotkey, or an automatic lock-on-lid-close option that immediately disables Touch ID and locks your screen, restoring password-only protection without killing your session or shutting down."
I've more details on the apps landing page - paniclock.github.io
itsdesmond 6 hours ago [-]
A person might use it to stop someone getting into your computer through certain types of physical coercion, forcing your finger to the reader, or (much less likely but I’m sure security services know how) a copy of your fingerprint.
But it isn’t a why, it is a what. That what is a tool that lets you quickly disable Touch ID for whatever reason you want to.
ttul 7 hours ago [-]
The 2026 version of "Boss Key".
Forgeties79 7 hours ago [-]
PSA to iOS users: if you tap the lock button 5x it forces password-only unlocking. Useful at protests or any precarious situations with law enforcement.
jonpalmisc 5 hours ago [-]
This still leaves your device in an AFU (after first unlock) state, with user data decrypted, and should not be treated as secure.
The only thing you can do (to protect your data from forensics, etc) is to return it to BFU by shutting it off.
seanieb 5 hours ago [-]
Correct. This is a classic security vs convenience tradeoff. I mention that trade off on the landing page, PanicLock vs Shutdown
> Use shutdown when you can, PanicLock when you can't. Shutting down is the most secure option—but when you need your Mac locked now and you'll be back in five minutes, PanicLock is your answer.
*PanicLock*
- Fast "oh shit" button
- Lid closed when in transit.
- Instant lock (1 second). Disables Touch ID immediately
- Preserves your session
- Back to work in minutes
*Full Shutdown*
- Maximum security
- Purges encryption keys
- Fully locks FileVault
- Takes time to shutdown & restart
- Kills your session
Forgeties79 5 hours ago [-]
Better than nothing and keeps them from having unlocked access. You can do it fast in your pocket.
ASalazarMX 32 minutes ago [-]
- TSA: Hey, bring your bag and devices here. Routine inspection.
- Traveler: [takes phone from the bin] [finds lock button] [click] [click] [click]
- TSA: Hey, stop what you're doing Mr. Terrorist!
chuckadams 6 hours ago [-]
Bringing up the shutdown screen (hold lock and either volume button) will also do it.
itsdesmond 6 hours ago [-]
I did not know that. That is extremely convenient. Thank you.
freehorse 5 hours ago [-]
Tapping it 5 (6? 7? 20?) times works better while panicked, though.
sigio 6 hours ago [-]
On GrapheneOS (and maybe android generic?) this calls the emergency number, I just found out (with a 5 second timer to cancel this luckily)
orthogonal_cube 6 hours ago [-]
Honestly I’m surprised this wasn’t already a feature in macOS. Thank you for coding it and publishing as open-source!
nailer 3 hours ago [-]
If someone can force you to use touch id they can probably also force you to enter your password.
(If you’re about to comment about fingerprints on transparency film and balloons filled with warm water then yes good point)
Rendered at 00:34:17 GMT+0000 (Coordinated Universal Time) with Vercel.
I remember way back in the day, there was some question as to the legality of compelled unlocking of devices; IIRC, it’s been deemed legal to compel a fingerprint, but illegal (under the first amendment?) to compel entry of a password—IIRC, as long as that password hasn’t been written down anywhere.
I gather this is written to that end primarily? Or is there some other goal as well?
https://www.yahoo.com/news/articles/washington-post-raid-pro...
Edit: I've a lot more details about the legality and precedence on the apps landing page https://paniclock.github.io/
I can't speak to the current generation of Apple fingerprint scanners, but historically iirc you can grab a print, clean it up in Photoshop, print it on OHP transparency using a laser printer and use it like a mould to copy a fingerprint.
This is not true outside of a narrow exception. Indeed this is the core point of the 5th Amendment, to protect you from having to be witness against yourself. It's just as binding on the judicial branch as it is on the executive. Ordinarily, a court may not compel a defendant to testify or say something that could incriminate them.
The narrow exception is the "foregone conclusion doctrine", which allows compelling testimony about specific evidence the government legally knows exists, knows the defendant controls access to, and knows is authentic. All of which has a bunch of caselaw around it. The textbook example is somebody has a device open, and an officer directly witnesses illegal material on it, but before they can seize it the person manages to turn it off and now it cannot be accessed without a password. So the government can say "we witnessed this specific illegal material, and this device is owned by the defendant and we can prove from video that they have accessed the device, and we want access to that specific material". But if you're just crossing the border with a locked device, they cannot compel the password just to search through it, or even if they're suspicious of something specific. They need actual knowledge, either through their own evidence or because the person foolishly talks and confesses something.
Otherwise they can definitely physically seize the device for a time (which could be very inconvenient/expensive depending) but that's it.
https://paniclock.github.io/
May I introduce you to XKCD Number 538.
https://xkcd.com/538
If the threat model includes state-level actors, then disabling biometrics won't prevent data from being retrieved from physical memory. It would probably be wiser to enable disk encryption and have a panic button that powers down/hibernates the computer so that no unencrypted data remains on RAM.
The website says shutdown "takes time" and "kills your session" but a hibernation button would take effect just as fast and would preserve the session.
A random cop might have access to a Cellebrite machine but they can't just call up the NSA and ask them to break into some drug dealer's macbook.
Gently close? no action.
Stronger, faster action? Disable touch ID
Slam shut in full panic? yeah disable all biometrics, lose all state, even wipe the ram and the filevault key if it's an option
> "PanicLock fills a gap macOS leaves open: there is no built-in way to instantly disable Touch ID when it matters. Biometrics are convenient day-to-day, and sometimes preferable when you need speed or want to avoid your password being observed. But in sensitive situations, law enforcement and border agents in many countries can compel a biometric unlock in ways they cannot with a password. PanicLock gives you a one-click menu bar button, a customizable hotkey, or an automatic lock-on-lid-close option that immediately disables Touch ID and locks your screen, restoring password-only protection without killing your session or shutting down."
I've more details on the apps landing page - paniclock.github.io
But it isn’t a why, it is a what. That what is a tool that lets you quickly disable Touch ID for whatever reason you want to.
The only thing you can do (to protect your data from forensics, etc) is to return it to BFU by shutting it off.
> Use shutdown when you can, PanicLock when you can't. Shutting down is the most secure option—but when you need your Mac locked now and you'll be back in five minutes, PanicLock is your answer.
*PanicLock* - Fast "oh shit" button - Lid closed when in transit. - Instant lock (1 second). Disables Touch ID immediately - Preserves your session - Back to work in minutes
*Full Shutdown* - Maximum security - Purges encryption keys - Fully locks FileVault - Takes time to shutdown & restart - Kills your session
- Traveler: [takes phone from the bin] [finds lock button] [click] [click] [click]
- TSA: Hey, stop what you're doing Mr. Terrorist!
(If you’re about to comment about fingerprints on transparency film and balloons filled with warm water then yes good point)