Comment 6 for bug 235297

Sorry, I've been revisiting bugs related to my account, and I didn't read the initial report enough to refresh my memory. On review, the SSH thing already been addressed, but I should note that in my first reply I meant "fingerprint is insecure unless..".

I could imagine making requiring tf-tool run as root, so that enrolling a new fingerprint requires a reauthentication, but if they've enrolled a print as sudo authorative it may already be too late. Moreover .birs seem to be transferable between devices, which means you could just bring along your own bir file rather than let tf-tool make a new one. The upstream project added ACLs to place fingerprints in your homedir owned by root but user readable, but my conversations with developers suggest that ACLs won't be enabled by default until a proper interface is created.