Voting for next features

[phucvinh57]

After considering the voice authentication feature carefully, we realized that it is unstable and complex to implement. The input is highly dependent on microphone quality and environmental conditions. Therefore, we will not move forward with it.

However, we received recommendations from community, which are interested:

• Welcome to biopass Discussions! #54 (comment)
• [Feature Request] Password Support #46 (comment)

[kunningKing11]

Also maybe add a feature where, instead of having options for either parallel or sequential trying of the authentication methods until one succeeds, you can choose to have multiple required methods of authentication, e.g., you need face AND fingerprint or fingerprint AND PIN, etc.

[kunningKing11]

I'm not sure but doing a quick GitHub search for voice auth gives a list of some promising ways to implement voice authentication.

I'm not sure if the refactoring would be difficult (since both projects are written in Python):
Result no. 1: both face and voice authentication; use just the face part
Result no. 2: just voice authentication

The first one has the most stars and is much better documented but may be harder to refactor to C++ considering there is also the face authentication component in the code.

[thaitran24]

Thanks for the suggestion. We considered voice authentication, but we decided not to include it at this stage because it would significantly increase the project scope.

A voice module is not just speaker recognition, it also needs additional components such as voice activity detection and voice anti-spoofing. In particular, anti-spoofing is still a challenging part of the problem and often requires extra model compression, tuning, and evaluation for resource-constrained devices. On top of that, voice authentication is more sensitive to the recording setup and audio input pipeline.

So for now, we think it is better to keep the scope focused on face authentication and deliver a more stable version. We will revisit this feature when time and resources allow.

[kunningKing11]

no problem, thanks for letting me know!

[kunningKing11]

@phucvinh57 Is there some sort of roadmap or timeline when we will implement these features

[phucvinh57]

Hi @kunningKing11, thanks for caring about the development of Biopass.

I have been busy recent weeks. I will go back at the end of this month, then I will create a clear roadmap for fixing current issues and releasing next features.

[kunningKing11]

No problem @phucvinh57. A roadmap at the end of the month would be very helpful. Looking forward to it! 👀

[phucvinh57]

Biopass (view) @kunningKing11 I have categorized issues into workstreams. I cannot ensure my expense time on this project, so I have not set up iterations. However, at least, I have set priority for them.

[kunningKing11]

@phucvinh57 lgtm!

[MyHomeMyData]

I've been looking into Biopass as a Windows Hello alternative for Linux Mint, and I think it has great potential. While exploring how to integrate it properly, I came across an interesting reference point: the PAM approach used by Fingwit, Linux Mint's new fingerprint authentication tool.

Current Biopass PAM setup

According to auth/pam/README.md, the current configuration is:

auth    required libbiopass_pam.so
account required libbiopass_pam.so

The README itself warns this may crash sudo — which suggests the current PAM integration is still in an early state.

How Fingwit handles it

Fingwit uses a smarter PAM control flow that gracefully falls back to password authentication when biometrics are unavailable:

auth [authinfo_unavail=1 default=ignore] pam_fingwit.so
auth [success=end default=ignore] pam_fprintd.so max-tries=1 timeout=10
auth [success=1 default=ignore] pam_unix.so nullok

This approach works seamlessly with the Cinnamon Screensaver, GDM, sudo and pkexec — without requiring any changes to those applications. It also ships a pam-auth-update-compatible configuration, so users on Debian/Ubuntu-based systems can enable it with a single command.

The idea

Would it make sense for Biopass to adopt a similar pattern? Concretely, I'm wondering about:

• Using [authinfo_unavail=1 default=ignore] instead of required to allow graceful fallback
• Renaming libbiopass_pam.so to pam_biopass.so to follow PAM naming conventions and enable pam-auth-update integration
• Dropping the account required line (unless there's a reason for it I'm missing)

I'm not a PAM expert, so I may be missing something here — but the Fingwit approach seems like a proven blueprint that has been accepted by the Linux Mint team. Biopass adopting the same pattern would make it a natural companion: covering face recognition where fprintd/Fingwit stops, while integrating cleanly into the same PAM stack.

Happy to hear your thoughts on whether this is feasible or if there are technical reasons the current approach was chosen.