I got Howdy face unlock to also unlock my keyring, using the TPM — because a face can't be an encryption key

Howdy gives you face login on Linux. What it doesn't give you is a password — and gnome-keyring, KWallet and friends want one. So you get recognised by your face, and then asked for your password anyway. Which rather defeats the point.

I spent a while trying to fix this the obvious way and it can't work, so I want to explain why before the actual solution, because the why is the interesting part.

Why you can't just hash your face

The obvious idea is: take the face encoding, hash it, use that as the key.

Face encodings are fuzzy. Here are six enrolments of my own face, captured seconds apart on the same camera, compared pairwise:

encoding 0 vs 1 : 0.0829

encoding 0 vs 4 : 0.3609

encoding 1 vs 4 : 0.3846

encoding 2 vs 5 : 0.3166 (identical vectors would be 0.0000)

Every capture is a different 128-float vector. That's why face matching uses a distance threshold rather than equality — Howdy accepts anything under ~0.57. A hash of one encoding is unrelated to a hash of the next, so there's nothing stable to derive a key from.

And even if you solved the noise: your face isn't secret, and the model file sits on disk right next to whatever it would be protecting.

What actually works

The biometric doesn't become the key. It authorises the TPM to release one.

face match -> authorises -> TPM unseals -> a real, stable secret

(fuzzy) (hardware) (exact)

Seal your keyring password to the TPM, and have a PAM module unseal it after Howdy authenticates and hand it to the stack as PAM_AUTHTOK. gnome-keyring picks it up and unlocks. No prompt.

That's it. ~250 lines of C.