[HN Gopher] Show HN: PanicLock - Close your MacBook lid disable ...
___________________________________________________________________
Show HN: PanicLock - Close your MacBook lid disable TouchID ->
password unlock
Author : seanieb
Score : 94 points
Date : 2026-04-17 16:38 UTC (6 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| mrdomino- wrote:
| Neat idea.
|
| I remember way back in the day, there was some question as to the
| legality of compelled unlocking of devices; IIRC, it's been
| deemed legal to compel a fingerprint, but illegal (under the
| first amendment?) to compel entry of a password--IIRC, as long as
| that password hasn't been written down anywhere.
|
| I gather this is written to that end primarily? Or is there some
| other goal as well?
| seanieb wrote:
| I wrote this after the case of a Washington Post reporter,
| Hannah Natanson, was compelled to unlock her computer with her
| fingerprint. This resulted in access to her Desktop Signal on
| her computer, revealing sources and their conversations.
|
| https://www.yahoo.com/news/articles/washington-post-raid-pro...
|
| Edit: I've a lot more details about the legality and precedence
| on the apps landing page https://paniclock.github.io/
| mrdomino- wrote:
| Cool, thank you.
| xoxxala wrote:
| The website has some more info on the biometric vs. password
| debate and legal situation:
|
| https://paniclock.github.io/
| 420official wrote:
| While it's true that the legality of law enforcement forcing
| passwords in unclear, courts can absolutely force you to enter
| a password even if it's not written down by holding you in
| contempt indefinitely.
| xoa wrote:
| > _courts can absolutely force you to enter a password even
| if it 's not written down by holding you in contempt
| indefinitely._
|
| This is not true outside of a narrow exception. Indeed this
| is the core point of the 5th Amendment, to protect you from
| having to be witness against yourself. It's just as binding
| on the judicial branch as it is on the executive. Ordinarily,
| a court may not compel a defendant to testify or say
| something that could incriminate them.
|
| The narrow exception is the "foregone conclusion doctrine",
| which allows compelling testimony about specific evidence the
| government legally _knows_ exists, knows the defendant
| controls access to, and knows is authentic. All of which has
| a bunch of caselaw around it. The textbook example is
| somebody has a device open, and an officer directly witnesses
| illegal material on it, but before they can seize it the
| person manages to turn it off and now it cannot be accessed
| without a password. So the government can say "we witnessed
| this specific illegal material, and this device is owned by
| the defendant and we can prove from video that they have
| accessed the device, and we want access to that specific
| material". But if you're just crossing the border with a
| locked device, they cannot compel the password just to search
| through it, or even if they're suspicious of something
| specific. They need actual knowledge, either through their
| own evidence or because the person foolishly talks and
| confesses something.
|
| Otherwise they can definitely physically seize the device for
| a time (which could be very inconvenient/expensive depending)
| but that's it.
| whalesalad wrote:
| Take it to the logical end - you can tie up / handcuff / sedate
| / restrain an individual in order to get their fingerprint (or,
| ahem, way worse) but you cannot extract a password from
| someones brain.
| stavros wrote:
| If it's in scope to "way worse" someone to get their
| fingerprint, I'm sure I can be very persuasive in getting
| their passwords.
| whalesalad wrote:
| You can get the fingerprint of a dead person... you cannot
| extract a password from a dead person.
| stavros wrote:
| Of course not. You extract it right before.
| vunderba wrote:
| > cannot extract a password from someones brain.
|
| May I introduce you to XKCD Number 538.
|
| https://xkcd.com/538
| ttul wrote:
| The 2026 version of "Boss Key".
| Forgeties79 wrote:
| PSA to iOS users: if you tap the lock button 5x it forces
| password-only unlocking. Useful at protests or any precarious
| situations with law enforcement.
| chuckadams wrote:
| Bringing up the shutdown screen (hold lock and either volume
| button) will also do it.
| itsdesmond wrote:
| I did not know that. That is extremely convenient. Thank you.
| freehorse wrote:
| Tapping it 5 (6? 7? 20?) times works better while panicked,
| though.
| sigio wrote:
| On GrapheneOS (and maybe android generic?) this calls the
| emergency number, I just found out (with a 5 second timer to
| cancel this luckily)
| jonpalmisc wrote:
| This still leaves your device in an AFU (after first unlock)
| state, with user data decrypted, and should not be treated as
| secure.
|
| The only thing you can do (to protect your data from forensics,
| etc) is to return it to BFU by shutting it off.
| Forgeties79 wrote:
| Better than nothing and keeps them from having unlocked
| access. You can do it fast in your pocket.
| seanieb wrote:
| Correct. This is a classic security vs convenience tradeoff.
| I mention that trade off on the landing page, PanicLock vs
| Shutdown
|
| > Use shutdown when you can, PanicLock when you can't.
| Shutting down is the most secure option--but when you need
| your Mac locked now and you'll be back in five minutes,
| PanicLock is your answer.
|
| *PanicLock* - Fast "oh shit" button - Lid closed when in
| transit. - Instant lock (1 second). Disables Touch ID
| immediately - Preserves your session - Back to work in
| minutes
|
| *Full Shutdown* - Maximum security - Purges encryption keys -
| Fully locks FileVault - Takes time to shutdown & restart -
| Kills your session
| p0w3n3d wrote:
| What's the rationale? It should be described in the README.md IMO
| itsdesmond wrote:
| A person might use it to stop someone getting into your
| computer through certain types of physical coercion, forcing
| your finger to the reader, or (much less likely but I'm sure
| security services know how) a copy of your fingerprint.
|
| But it isn't a why, it is a what. That what is a tool that lets
| you quickly disable Touch ID for whatever reason you want to.
| seanieb wrote:
| That's good feedback. I just added it to the readme:
|
| > "PanicLock fills a gap macOS leaves open: there is no built-
| in way to instantly disable Touch ID when it matters.
| Biometrics are convenient day-to-day, and sometimes preferable
| when you need speed or want to avoid your password being
| observed. But in sensitive situations, law enforcement and
| border agents in many countries can compel a biometric unlock
| in ways they cannot with a password. PanicLock gives you a one-
| click menu bar button, a customizable hotkey, or an automatic
| lock-on-lid-close option that immediately disables Touch ID and
| locks your screen, restoring password-only protection without
| killing your session or shutting down."
|
| I've more details on the apps landing page -
| paniclock.github.io
| quicklywilliam wrote:
| Great idea and implementation! If you are hesitant to install
| this for any reason, you can accomplish the same thing with this
| one liner: sudo bioutil -ws -u 0; sleep 1; sudo
| bioutil -ws -u 1
|
| Edit: here's a shortcut to run the above and then lock your
| screen. You can give it a global keyboard shortcut in the
| Shortcuts app.
| https://www.icloud.com/shortcuts/9362945d839140dbbf987e5bce9...
| alin23 wrote:
| Hook this to a lid angle below 30deg trigger in
| https://lowtechguys.com/crank and you can easily make it run on
| a simple lowering of the lid
| Wowfunhappy wrote:
| At that point, why not just disable Touch ID?
| orthogonal_cube wrote:
| Honestly I'm surprised this wasn't already a feature in macOS.
| Thank you for coding it and publishing as open-source!
| freehorse wrote:
| This is great. I see many times "security advice" against
| biometrics replacing password unlock, but most of the time I am
| more worried about getting recorded by somebody/something while
| typing a password in the open than anything else. This makes it
| better for those other cases.
| gruturo wrote:
| This would be perfect if it could monitor the force with which
| the lid is closed (macs have accelerometers after all, either
| this info or an acceptable proxy could be derived?).
|
| Gently close? no action.
|
| Stronger, faster action? Disable touch ID
|
| Slam shut in full panic? yeah disable all biometrics, lose all
| state, even wipe the ram and the filevault key if it's an option
| QuercusMax wrote:
| You must not have cats or children if you think that last one
| is reasonable
| gruturo wrote:
| Ok just unload the filevault key from ram, better? And if
| possible tell the secure enclave to revert to the before-
| first-unlock state
| thih9 wrote:
| Perfect rage quitting machine. There should be an enterprise
| version: when lid is closed with full force it also sends a
| professional resignation letter to the current employer.
| wolvoleo wrote:
| I'm surprised Apple doesn't offer an option. On the iPhone you
| could do this by pressing the power button several times. Not
| sure if this still works because the iPhone 6 was my last one
| though.
| bhj wrote:
| Pressing and holding Power + Vol Up/Down is the current combo
| nailer wrote:
| If someone can force you to use touch id they can probably also
| force you to enter your password.
|
| (If you're about to comment about fingerprints on transparency
| film and balloons filled with warm water then yes good point)
| rglover wrote:
| This is awesome, thank you. Was just thinking about this problem
| the other day. Glad someone whipped something up.
| surround wrote:
| > in sensitive situations, law enforcement and border agents in
| many countries can compel a biometric unlock in ways they cannot
| with a password.
|
| If the threat model includes state-level actors, then disabling
| biometrics won't prevent data from being retrieved from physical
| memory. It would probably be wiser to enable disk encryption and
| have a panic button that powers down/hibernates the computer so
| that no unencrypted data remains on RAM.
|
| The website says shutdown "takes time" and "kills your session"
| but a hibernation button would take effect just as fast and would
| preserve the session.
| jovial_cavalier wrote:
| a cop works for "the state," but he's definitely not a "state-
| level actor."
| surround wrote:
| How do you define "state-level actor?" Police departments
| certainly have access to state and federal forensic resources
| to access unencrypted data in memory.
| LoganDark wrote:
| Apple Silicon is at least much more difficult to attack in this
| way, though it might be possible.
___________________________________________________________________
(page generated 2026-04-17 23:01 UTC)