Enable/disable based on location

[squatto]

Ensuring that my machine locks automatically when I walk away is an extremely helpful feature to have while I am at work, but it's really annoying at home 😂 I use my Apple Watch as the monitored BT device, so when I'm at home and it's charging (or someone else is using my laptop, etc.), my machine ends up locking itself at inconvenient times. I could certainly just disable BLEUnlock while I'm at home, but I'll inevitably forget to enable it when I get back to work.

What would be really awesome would be to enable/disable locking based on the location of the device. This would be similar to how focus modes can be enabled based on a location. e.g. my "Work" focus mode turns on when I get my office:

Thanks!

[squatto]

I was going through issues today and noticed that this was suggested in #86

[ts1]

Thank you @squatto.
I think I will try to implement this using a Wi-Fi AP (SSID).
I would like to discuss the security impact and other insights on it if anyone has any knowledge about it.

[squatto]

My pleasure!

I’m certainly not a security expert, but as long as there isn’t any information being sent out of the app, I can’t think of any negative security impacts of going the wifi SSID route. It’s essentially just string matching, isn’t it?

[ts1]

Yes, but if, for example, someone who knows your home WiFi SSID and password sets up a router that replicates them in your office, and your Mac connects to it (perhaps temporarily taking down the main router? ), your Mac will be unprotected.
I know this is a rather unlikely scenario to happen, but if a more secure implementation is possible, I would like to do so.

[DigiH]

Hi, following this with interest and wondering if also including the BSSID(s) could help getting this a bit more secure.
Still spoofable, but with one extra detail.

[ts1]

@DigiH Yes, but I'm not sure if it works okay on mesh networks.

[DigiH]

Yes, I was wondering about that as well and put the plural (s) in BSSID(s).

For large company meshes this is not really doable, but if restricted as an additional check, only when being used for not locking, which is mostly at home, being able to enter a few mesh BSSIDs manually, or by confirming the connection to them might be a possibility, admittedly requiring extra steps for entering/confirming these BSSIDs.

Just a thought.

[ts1]

Okay, I see. So, if we allow multiple BSSIDs (and ESSIDs for identification by users) to be registered, it seems that in most cases there will be no problem.

[DigiH]

I would very much assume so, but also have to admit that in my home with a single BSSID I couldn't easily test and verify it.

[squatto]

UPDATE 9/20/24: Do not use this method! Use the updated method found here instead!

---

I threw together a quick brute-force solution for the impatient 😉 This uses AppleScript to get the current wifi network's SSID, determines if it is your home network, and if so, kills BLEUnlock if it is running. If it isn't your home network, it launches BLEUnlock if it isn't already running.

As mentioned by @ts1 in this comment, relying solely on the SSID's name is susceptible to spoofing! This script is in NO WAY hardened or secure, and should be used at your own discretion.

---

Put this in ~/CheckBLEUnlock.scpt. Change your-ssid-here to your home SSID.

-- get the current wifi SSID
set ssid to do shell script "/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I | grep -w SSID | awk '{print $2}'"

-- check if we aren't connected to wifi (no SSID)
if ssid = "" then return

-- are we at home?
set atHome to false

if ssid = "your-ssid-here" then set atHome to true

-- is BLEUnlock currently running?
set appName to "BLEUnlock"
set isRunning to false

tell application "System Events"
    if exists process appName then
        set isRunning to true
    end if
end tell

-- if BLEUnlock is running and we are at home, kill it
-- if BLEUnlock is not running and we are not at home, run it
ignoring application responses
    if atHome and isRunning then
        tell application appName to quit
    else if not atHome and not isRunning then
        tell application appName to launch
    end if
end ignoring

Add this to your crontab. This runs the check every 5 minutes. Change as desired...

# kill BLEUnlock while at home, launch it while not at home
*/5 * * * * osascript ~/CheckBLEUnlock.scpt 2>&1

Keep in mind, if you add this to your crontab, you won't be able to manually quit BLEUnlock while you're not at home because it will automatically re-launch whenever the script runs.

[squatto]

You could base this off of the BSSID, if you wanted it to be more secure. The airport command only shows the BSSID when run as sudo, so you would need to change the grep to match BSSID, change your-ssid-here to your home wifi BSSID, and add the script to the root user's crontab (sudo crontab -e).

[squatto]

A quick update for anybody that lands here looking for a solution: as of macOS Sonoma 14.4, the airport command used in the script above can no longer be used to get the current SSID:

$ /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I
WARNING: The airport command line tool is deprecated and will be removed in a future release.
For diagnosing Wi-Fi related issues, use the Wireless Diagnostics app or wdutil command line tool.

For a while, you could run networksetup -getairportnetwork en0 to get the current SSID, but that no longer works: (I am connected to a wifi network...)

$ networksetup -getairportnetwork en0
You are not associated with an AirPort network.

The only working solution that I am aware of is to run sudo wdutil info - but it has to be run as sudo, which is problematic for automation tools, cron scripts, etc.

Here's a full command to get the current SSID:

sudo /usr/bin/wdutil info | /usr/bin/awk '/SSID/ { print $NF }' | head -n 1

[squatto]

UPDATE 9/20/24: Do not use this method! Use the updated method found here instead!

---

Here is an updated version of my script that works at least up until macOS Sequoia 15.1 Beta (24B5024e). Because it uses wdutil info to retrieve the SSID, it MUST be run as the root user. More info below.

---

IMPORTANT: Everything below MUST be done as the root user

Put this in /var/root/CheckBLEUnlock.scpt. Change your-ssid-here to your home SSID.

-- make sure that we are running as the "root" user
set currentUser to do shell script "whoami"

if currentUser is not "root" then return

-- get the current wifi SSID (this requires administrator privileges!)
set ssid to do shell script "/usr/bin/wdutil info | /usr/bin/awk '/SSID/ { print $NF }' | head -n 1" with administrator privileges

-- if there isn't an SSID, then we either aren't connected to wifi or we can't determine the SSID
if ssid = "" then return

-- are we at home?
set atHome to false

if ssid = "your-ssid-here" then set atHome to true

-- is BLEUnlock currently running?
set appName to "BLEUnlock"
set isRunning to false

tell application "System Events"
    if exists process appName then
        set isRunning to true
    end if
end tell

-- if BLEUnlock is running AND we are at home, then kill it
-- if BLEUnlock is not running AND we are not at home, then run it
ignoring application responses
    if atHome and isRunning then
        tell application appName to quit
    else if not atHome and not isRunning then
        tell application appName to launch
    end if
end ignoring

Run the script as root by adding it to the root user's crontab (sudo crontab -e). For example, the following will run the check every 5 minutes. Change as desired...

# kill BLEUnlock while at home, launch it while not at home
*/5 * * * * /usr/bin/osascript ~/CheckBLEUnlock.scpt 2>&1

Keep in mind, if you add this to your crontab, you won't be able to manually quit BLEUnlock while you're not at home because it will automatically re-launch whenever the script runs.

[squatto]

I came up with a much better (and MUCH easier) way of doing this than I outlined in my last reply. It is easily accomplished using Shortcuts and a single cronjob.

The shortcut essentially does the same thing that the AppleScript in my previous replies was doing: use the name/SSID of the current wifi network to determine if you are at home and open or close BLEUnlock accordingly.

You can download the shortcut here: https://www.icloud.com/shortcuts/fa9e18d09e8346e48ae50eb153433d46

There are comments in the shortcut that go over exactly how to set it up. Let me know if you have any questions!

[timtrace]

I came up with a much better (and MUCH easier) way of doing this than I outlined [in my last reply]

Thank you! I wanted BLEUnlock to run only when my MBP was connected to my docking station in my home office, so I shamelessly plagiarized your shortcut :) I incorporated it into my "timed actions" shortcut that greps SYSTEM_PROFILER for the dock and takes a lot of small actions like turning off TrueTone and setting the MacOS dock location and size for use with a 32" monitor. Now my Shortcut also starts BLEUnlock when docked and stops it if not. :)