Secure PDAs

An anonymous reader writes "This article at LinuxDevices.com introduces a unique Linux-based 'secure PDA' co-developed by IBM and Consumer Direct Link, Inc. (CDL). The Paron MPC combines the functions of a PDA, Bluetooth wireless access, cellular telephone, and biometric fingerprint recognition, along with a security-oriented hardware/software architecture. The device is claimed to be the world's first handheld wireless device with built-in biometric user authentication. The Paron is based on an Intel StrongARM SA-1110 processor and uses a Linux 2.4.x kernel and provides a GUI environment and PDA app suite based on Trolltech's Qtopia and Opera's browser much like the Sharp Zaurus."

Comments

never work

[TerryAtWork]

Bruce Schneier has handled this in his book
Secrets and Lies.

http://www.amazon.com/exec/obidos/tg/detail/-/04 71 253111/qid=1036775441/sr=8-1/ref=sr_8_1/102-248505 7-0576118?v=glance&s=books&n=507846

Biometrics is not ready for prime time. When they hack it, are you going to be isssued a new thumb?

Re:never work

[fermion]

It has been a while since I have read that book, and I don't have it in front of me, but if i recall he realized that in Applied Cryptography he implied that properly vetted and implemented algorithms would imply security. In the fullness of time he realized that the view was naive. As such, S&L was written to convey the message that algorithms alone are insufficient. A secure system must consider users, application, the nature of the security threat, and the cost of breached security, As such, in general, all security methods fall short.

In this case, IBM tends to market to sophisticated markets. They tend to, and are increasingly, trying to serve the sophisticated market in new ways so as not to lose to MS, Dell, and others. Hopefully we will not see these devices everywhere, because, as you say, once a thumbprint is compromised it is always compromised. I honestly do not know if this is a useful tool, but i can imagine some applications where it could be.

On the other hand if MS did this, your point might be valid because then the technology would be shoe-horned into general use. For instance, if the validation was in the OS and IE, and the reader were on the keyboard, thousands of merchants might use the fingerprint for sole verification. This would create a large incentive to hack the system, which, a you point out, would only require the capture of the digital signature of the fingerprint, which is not a replaceable token.

you must admit

[Faggot]

If microsoft did "biometric user identification", we'd be screaming bloody 1984. Instead, it's linux-based. Neat-o.

There's plenty of automatic-MS-bashing that goes on here, and plenty of automatic-MS-bashing-bashing. But if you look at the facts and stick to the numbers, it's not very farfetched to assume Microsoft is always trying to screw us somehow.

Look at Palladium, with which they will entrench DRM on every desktop. Look at Word's closed and obfuscated binary file format. Look at all their OEM tricks, and EULA abuse, their fake Switch ads and their systematic abuse of power.

Their strategy (whose final step is most assuredly "PROFIT !!") has been to fuck consumers and users as much as they can get away with and rob their pockets of change. Next to a Finnish hobbyist's OS, they look pretty bad.