[FEATURE REQUEST] Windows Hello Counterpart

[abrhst]

Hello.

I was wondering if you could get something like Windows Hello and make it work with passkeys (Windows Hello to sign in) just like on Windows.

Thank you

[Anduin2017]

Try this project?

https://github.com/boltgolt/howdy

sudo add-apt-repository ppa:boltgolt/howdy
sudo apt update
sudo apt install howdy

However, unlike real Windows hello is an end-to-end security solution, Howdy is a pure software implementation and less secure than real Windows hello.

[abrhst]

Try this project?

https://github.com/boltgolt/howdy

sudo add-apt-repository ppa:boltgolt/howdy
sudo apt update
sudo apt install howdy
However, unlike real Windows hello is an end-to-end security solution, Howdy is a pure software implementation and less secure than real Windows hello.

Problem is that I don’t have a IR camera for Windows hello nor do I have a fingerprint sensor, so I want something like a PIN windows hello system so you can use it for the same purpose

[Anduin2017]

In the Linux world, there is no direct equivalent to Windows Hello. That’s because Windows Hello is built on a full trust chain that ensures hardware integrity and secure identity verification. Faulty or tampered hardware won't accidentally bypass Windows Hello, and everything is backed by TPM. If the computer is physically compromised, Windows Hello will still block access.

In contrast, Linux doesn’t enforce any such trust chain. Anyone can write a PAM module and define their own authentication logic. That means you can unlock your computer using literally any method you want, because the system doesn’t enforce any unified security model.

If you want a feature similar to PIN login, you can simply set a short password—something like "192893". Surprisingly, this isn’t necessarily insecure if your system uses full disk encryption. Trying this password through brute force isn’t cheap for an attacker, because GDM (the GNOME Display Manager) introduces rate limiting. If someone enters the wrong password multiple times, the system will enforce delays, effectively preventing brute-force attacks.

Of course, this isn’t as secure as the native Windows Hello implementation, but the practical effect is very similar for most users.

If you're looking for real security, I recommend enabling full disk encryption and binding the disk to TPM for automatic decryption. This gives you security comparable to BitLocker. Even if someone gains physical access to your machine, they’ll find it very difficult to access your data. And you can still log in quickly with a short password or PIN-like input.

If you have questions about how to setup, I will add some document about that.

[abrhst]

Okay thank you