Feature Request: Facial Recognition for Login and Screen Unlock

[siyamsec-lab]

Summary

Add optional, local facial-recognition authentication to AnduinOS for user login and screen unlocking.

Motivation

Modern operating systems increasingly provide biometric authentication as an alternative to entering a password. AnduinOS could provide a similar experience while keeping the implementation lightweight and privacy-focused.

This would be particularly useful for laptops and devices with an integrated or USB webcam.

Proposed Feature

Provide an optional facial-authentication mechanism that allows an enrolled user to authenticate using their face for:

• Graphical login
• Screen unlock
• Session authentication where appropriate

The existing password/PIN authentication method should remain available as a fallback.

Technical Approach

The implementation should integrate with the Linux authentication infrastructure, preferably through PAM, rather than implementing authentication separately inside the desktop environment.

A possible architecture would be:

Webcam
   ↓
Face Detection
   ↓
Face Recognition / Verification
   ↓
PAM Authentication Module
   ↓
Login / Unlock

The implementation should be compatible with the existing AnduinOS login and lock-screen stack.

Privacy

Facial authentication should be designed with privacy as a primary requirement.

The default implementation should:

• Process camera data locally
• Require explicit enrollment by the user
• Avoid uploading images or biometric data
• Avoid requiring an online account
• Store biometric templates securely
• Provide an easy way to remove enrolled biometric data
• Clearly indicate when the camera is being accessed

Raw facial images should not be retained unnecessarily.

Security

Facial recognition should be treated as an authentication mechanism rather than merely a convenience feature.

The implementation should consider:

• Anti-spoofing/liveness detection where practical
• Protection against photographs and screen replays
• Secure storage of biometric templates
• Rate limiting failed attempts
• Password fallback
• A clear recovery mechanism if facial authentication fails

For higher-security operations, the system could require the user's password or another authentication factor rather than relying exclusively on facial recognition.

User Experience

A user could enroll their face through a simple settings interface:

Settings
 └── Security
      └── Facial Authentication
           ├── Enroll Face
           ├── Test Recognition
           ├── Enable for Login
           ├── Enable for Screen Unlock
           └── Remove Face Data

During login or unlock:

Looking for your face...

        [ Camera ]

Face recognized ✓

Unlocking...

If recognition fails:

Face not recognized.

[Try Again]    [Use Password]

Optional Configuration

Users should be able to configure:

• Enable/disable facial authentication
• Login authentication
• Screen-unlock authentication
• Recognition timeout
• Maximum failed attempts
• Re-enrollment/removal of biometric data

Compatibility

The feature should degrade gracefully on systems without a compatible webcam or hardware.

Users without a supported camera should continue to use the existing authentication methods without additional configuration.

Initial Scope

A reasonable first implementation would support:

1. Face enrollment
2. Local face verification
3. PAM integration
4. Graphical login authentication
5. Screen unlock
6. Password fallback
7. Secure removal of enrolled biometric data

More advanced liveness detection and hardware-backed biometric storage could be considered in later releases.

Expected Benefit

This would provide AnduinOS users with a convenient biometric login/unlock option while maintaining the project's lightweight and privacy-oriented approach.