Slashdot Mirror
Acer Laptop W/Fingerprint Recognition System
Dekaner writes "Acer has announced the TravelMate 740 with a built-in fingerprint recognition security system. The fingerprint sensor is part of the notebook? s palm rest. Users must train the recognition system, which is then used to boot the machine or to decrypt files stored on the hard disk. The TravelMate has a 1.2 GHz Pentium III processor, a 15-inch screen with a resolution of 1400 by 1050 pixels, built in 56K modem and Ethernet connection, and it can be supplied with either 128 or 256 MB of memory. It can be configured with a second hard disk, CD-ROM, DVD, or a DVD-CD-RW drive. It will go on sale in October."
The article is short on details but it seems not to be very reliable. In corporations, the IT department usually has a master key so that even when the employee leaves, the company can still retrieve the data. What about this fingerprint-recognition system?
Second, this article makes me wonder if Slashdot will consider inserting text ads like Google by masquerading as submissions. I think it is a great way to get income to maintain this heavyly used site (banners at the top are no longer very effective), given the financial conditions of the parent company VA Linux.
¦ ©® ±
Don't keep data on this thing that's worth dismemberment, because scary terrorist-types will cut your fingers off.
Nah - these things can tell a dead finger - blood, pulse, rigor mortis etc. You need to have it attached to you when you use it. Of course, this presents a problem if you do something disfiguring to your finger (don't joke, it happens!), and you can't get at your files. What's more, someone can just hold a gun to your head until you put your finger on the pad...so it's by no means foolproof.
This sort of biometric authentication is not really all that vital for most of us, and the effort required to keep it functional, in this case at least, outweighs any advantage gained.
Don't get me wrong -- I can see this being very useful for corporations and governments who have valuable information to keep encrypted. For those applications, this is a good idea.
The problem I see is that fingerprint sensors require maintenance. The human fingertip exudes oil, used to increase the traction of the fingertip. This is not good for a sensing surface, and will necessitate regular cleaning. Anyone who has owned a trackball can tell you that anything the finger touches regularly, builds up gunk quickly.
Another problem is susceptibility to damage -- scratches in particular. I wouldn't want to be locked out of my files due to clumsiness. Also, damage to the recognition system through any form of clumsiness will keep you out of your encrypted files. Using an ordinary encryption method, you'd just hook the HD up to a different machine and be back in business.
I'll assume that the device is good enough to detect your print accurately. I wouldn't think the company would willingly release a half-engineered product in such an important area as authentication.
Denial isn't just a river in Italy
After doing some research, I recommended to my girlfriend that she buy an Acer laptop. The reasons were simple - it had a modem, ethernet, and wireless ethernet built in, it had a large 14" screen, and it was only 5.2 pounds with the dvd drive installed, 4.5 without, and came installed with Windows 2000.
I looked at a variety of other laptops, especially Dell and Compaq, and none could build in everything (she wanted wireless ethernet for use at college and in the future) at such a low weight. The price wasn't too bad either, for last June - about $2100 including Windows 2000 and Office 2000 from CDW.
When it arrived, there was a feature I sort of brushed over - a smart card reader. Its primary purpose in this laptop is to restrict access if the card is not installed. It looks like a credit card, and is easily removable. By default, the security settings are such that the smart card must be installed for the computer to boot. Of course, this isn't perfect protection against things like theft, but it is more convenient than a boot password to prevent people from simply using the laptop.
So I am not surprised to see that Acer is leading the way with more laptop security features. I absolutely hate the many old desktops that I have had to fix over the years, but the quality of the laptops is quite nice. They fit a lot of features, including some pioneering ones, into a laptop that is comparable in price to Toshiba and Dell with less weight.
"The universe seems neither benign nor hostile, merely indifferent." --Carl Sagan
How many bits worth of unpredictable information, exactly, is in a fingerprint? I know it's "a lot", but is it enough? 48 bits is "a lot" too, but it has been demonstrated to be not enough for protection against a simple brute-force attack.
Ultimately, it's all just bits. This fingerprint-recognition device ultimately must convert your fingerprint into a binary key, and use that key to perform the encryption/decryption. If someone can get a copy of your encrypted data, they could run it through software which tried binary keys until it found the right one. If the adversary could lift your fingerprint from something you've touched, that might give them information which helps them narrow down the search.
Until I found out just how many keys they'd have to try before exhausting the keyspace, I wouldn't trust this to be secure. A good mixed-case/numbers password with a - or ! (et al) thrown in can easily have 67**8 > 48-bit strength. A 5-word english passphrase can have up to 38619 ** 5 > 76-bit strength (38619 words in
Seriously, though, does anyone know the strength of a key generated by Acer's gizmo? And how much it might be narrowed down with a sample fingerprint to work from?
-- TTK
A co-worker of mine got one of these Acer laptops with fingerprint recognition several months back, perhaps around April.
The fingerprint recognition was OK for one person, but as soon as we tried to configure it to recognize two people, we had horrible problems. It seemed like there were differences between the BIOS level recognition and the software OS level recognition. We were eventually both locked out and just sent the laptop in to be reset.