Acer Laptop W/Fingerprint Recognition System

Dekaner writes "Acer has announced the TravelMate 740 with a built-in fingerprint recognition security system. The fingerprint sensor is part of the notebook? s palm rest. Users must train the recognition system, which is then used to boot the machine or to decrypt files stored on the hard disk. The TravelMate has a 1.2 GHz Pentium III processor, a 15-inch screen with a resolution of 1400 by 1050 pixels, built in 56K modem and Ethernet connection, and it can be supplied with either 128 or 256 MB of memory. It can be configured with a second hard disk, CD-ROM, DVD, or a DVD-CD-RW drive. It will go on sale in October."

Comments

False security is worse than no security

[pesc]

The article fails to give a technical explanation on exactly how the fingerprints enhance security. Does anyone here really believe that this laptop can protect its data when it is stolen? In order to do that it must encrypt the data on the disk.

Using what encryption key? Your fingerprint? Does anyone believe that your fingerprints are secret? You are putting thousands of copies of your prints on various objects every day. You probably have several fingerprints on your laptop! And once your secret encryption key becomes known, how do you change your key? :-)

The key (sorry) to good encryption security is to change your keys often.

Until a good technical description on the security is provided I will regard this laptop as techno-babble trying to impress PHB types.

Re:False security is worse than no security

[hacker]

Having worked at $LASTJOB{PHARMA} where the FDA was looking over our potential implementatation of biometrics in wireless handheld webpads in 1998, I can tell you how this is done:

CFR 21:11 , the Code of Federal Regulations, goes through this fully. In order to be "validated" as the real person, you must hold at least two of three key pieces of information:

1. Something you have: A keycard, a physcal key, an iButton
2. Something you know: A password, passphrase, memorized key
3. Something you are: Iris scan, fingerprint, voice, some other biometric.

. If you have two of those things, any two in combination, you are said to be one of two things:

1. Truly that person to which the biometric belongs, or
2. A conspirator, working with that person, since you cannot have obtained the second piece of information without consent from the holder

This is how our Federal Government looks at it anyway.

Biometrics have come a long way, and contrary to popular belief, this fingerprint-style technology does not compare a "picture" of your finger. It measures datapoints (the FingerChip for example, measures many more datapoints than most biometric scanners, and is a fraction of the size).

The "retraining" you have to do is so that your "personality" is measured as one of the datapoints. If this was a signature capture biometric, it would measure whether or not you dot your "i" before your words are finished, or after. That "personality" is set in the equation as part of the measurement. This is why even if you have someone's signature on paper, and can replicate it perfectly freehand, a good biometric will rule it out, since the "personality" (speed to write, dot i's first/last, etc.) will certainly not match.