5.6 KiB
plasma-face-unlock
Face ID for KDE Plasma.
Look at the screen and it unlocks: the lock screen, sudo and admin prompts. A photo on a phone does not fool it.
Install | How to use | Is it safe? | Report a bug
Come back to your locked screen and look at it. A bubble drops down at the top, finds your face,
and you are in. It works for sudo and Plasma's admin prompts too, if you want. Everything runs on
your computer, and your face is saved as numbers, never as a picture.
Install
Arch, CachyOS, EndeavourOS, Manjaro (AUR)
yay -S plasma-face-unlock
Fedora
sudo curl -fsSL -o /etc/yum.repos.d/plasma-face-unlock.repo \
https://loonixtools.github.io/plasma-face-unlock/plasma-face-unlock.repo
sudo dnf install plasma-face-unlock
Debian, Kubuntu
codename="$(sed -n 's/^VERSION_CODENAME=//p' /etc/os-release)"
sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://loonixtools.github.io/plasma-face-unlock/KEY.gpg \
| sudo gpg --dearmor -o /etc/apt/keyrings/plasma-face-unlock.gpg
echo "deb [signed-by=/etc/apt/keyrings/plasma-face-unlock.gpg] https://loonixtools.github.io/plasma-face-unlock/deb/$codename ./" \
| sudo tee /etc/apt/sources.list.d/plasma-face-unlock.list
sudo apt update && sudo apt install plasma-face-unlock
The packages are built for the current release of each. Updates then come with your normal system updates.
You need Plasma 6 on Wayland and a camera. Infrared cameras (the Windows Hello kind) work too.
How to use
plasma-face-unlock
This opens a menu:
Press 1 and follow the setup window: look at the camera, then turn your head slowly in a circle until the ring is full. Then lock the screen and look at it. 2 adds another face, for example with glasses, and 5 runs one test scan that shows what the camera sees. Try that first when something does not work.
4 opens the settings. The text at the bottom says what the selected one does:
Without the menu: plasma-face-unlock enable, disable, setup [NAME], faces, remove ID,
test and status.
Is it safe?
It is a convenience, not a security upgrade. Face ID on a phone sees your face in 3D. A webcam only sees a flat picture.
- You do not have to blink. A photo on a phone or tablet, or a glossy print, is still refused: it gives itself away by its reflection and its straight edges.
- A matte printed photo can get past that. Set the photo check to strict in the settings: then the face has to blink or turn a little, and a photo can do neither.
- A video of you can still get in.
- Five failed tries in a row pause it for 15 minutes, or until you use your password.
- Only root can read your face data. Adding or deleting a face always needs your password.
- sudo and admin prompts never take a face over SSH.
If the computer guards something important, leave sudo and admin prompts off.
How it works
plasma-face-unlockd |
Runs as root when needed. It owns the camera and the face data and decides. |
plasma-face-unlock-agent |
Runs in your session. It watches the lock screen and draws the bubble. |
pam_plasma_face_unlock.so |
Lets sudo and admin prompts ask the daemon. No match: you type your password as usual. |
plasma-face-unlock |
The menu. |
Two small networks from the OpenCV model zoo find the face (YuNet) and turn it into numbers (SFace).
They run on the CPU in a few milliseconds. The lock screen is unlocked through logind, the same way
loginctl unlock-session does it. man plasma-face-unlock has all the details.
Build from source
make models # downloads the two networks and checks them
make
make test
sudo make install
You need CMake, a C++20 compiler, Qt 6, LayerShellQt, KI18n, OpenCV 4.5.4 or newer (with DNN),
Linux-PAM and libsystemd. scdoc and msgfmt are optional (man page, translations).
packaging/README.md explains releases.
Credits
- Glance by Jonathan Zhou (MIT): face unlock for the Mac. The idea, the look of the bubble and the photo check come from there. The code here is new.
- YuNet (MIT) and SFace (Apache-2.0) from the OpenCV model zoo.
License
GPL-3.0-or-later.