Slashdot Mirror

← Back to Stories (view on slashdot.org)

IBM Introduces Biometric Thinkpad

Posted by CmdrTaco on from the good-'cuz-i-forgot-my-password dept.

An anonymous reader writes "IBM has added biometric security to its thinkpad notebooks. The next generation of T series thinkpads will have an integrated fingerprint scanner for added security. The latest machines will also include some pretty cool encryption software, that will keep your hard disk safe, but still let you backup and restore images. This guy managed to get his hands on an early prototype T42 with the new security features integrated."

48 of 195 comments (clear)

  1. swipe scan by dirvish · · Score: 4, Interesting

    "IBM has chosen to go with a swipe-scanner rather than a touch-scanner, for a number of reasons. First and foremost is that a swipe-scanner provides better security. Because you have to drag your fingertip across the scanner, there is no way to "lift" a fingerprint from the surface."

    That is a great idea. Such an elegant solution to what could have been a big problem.

    --
    FoundNews.com - get paid to blog.,
    1. Re:swipe scan by saderax · · Score: 5, Insightful

      ...except for the multitude of partial prints left all over the keyboard and the touchpad...

    2. Re:swipe scan by cynic10508 · · Score: 4, Informative

      That is a great idea. Such an elegant solution to what could have been a big problem.

      Actually, the swipe scanner is cheaper, consumes less power, and has a smaller footprint than the original designs. So it's really best suited for devices such as cell phones, PDAs, etc.

    3. Re:swipe scan by Dman33 · · Score: 2, Interesting

      I love the swipe scanner that I have been using on my Ipaq H5450 for the past few years.

      (I always wondered why this was not common on laptops when it has been common on my PDA for so long...)

    4. Re:swipe scan by Anne+Thwacks · · Score: 2, Interesting
      That is a great idea. Such an elegant solution to what could have been a big problem.

      Or maybe not - what is wrong with a lock and key to open the laptop?

      Not only would it protect the data, it would prevent the HD and DVD combo from being stolen from the laptop while its sitting on the desk (happened to two colleagues lately).

      And stop the keyboard from being damaged by children and small animals.

      Given that the T series have titanium cases, a lot of force would be needed to open them and they would probably be wrecked if forced open (assuming a suitably strong lock.) This is the feature I want most next time I buy a T series (I have an IPaq with fingerprint recognition, and its great, but I would still prefer a lock and key for the laptop (I have a T series - they are great too).

      --
      Sent from my ASR33 using ASCII
    5. Re:swipe scan by Anonymous Coward · · Score: 3, Funny

      ... and has a smaller footprint than ...

      I'm afraid you completely misunderstood the article. You are supposed to swipe your finger across the scanner, not your foot!

      I hope this helped!

  2. Remember your friends by lifeblender · · Score: 3, Interesting

    Does this mean you can hack it to record your friends' (or co-workers') fingerprints? Sounds fun and scary.

    --
    Playing pornographics games during the day is evil! Play at night!
    1. Re:Remember your friends by tanguyr · · Score: 5, Informative

      Does this mean you can hack it to record your friends' (or co-workers') fingerprints? Sounds fun and scary.

      No, you can't. From the article:
      "Of course since the Power On security layer is something that occurs well before Windows has started up, the fingerprint data can't be stored in a Windows file or folder. Instead, the fingerprint scanner itself stores the fingerprint data and retrieves it when the Power On security request is made. You can store a total of 21 profiles in the scanner, which should be more than enough, unless you share one notebook between a score of users. If you're worried about someone extracting the fingerprint data from the scanner and breaking your security, dont be. The scanner only stores a tiny amount of data for each fingerprint, just enough to ensure an accurate match, and nowhere near enough to recreate a complete fingerprint."

      --
      #!/usr/bin/english
    2. Re:Remember your friends by swordboy · · Score: 2, Funny

      A new definition for "hacking":

      Pronunciation: 'hak-ing
      Function: verb
      The process of removing someone's finger so that you can gain access to their Thinkpad.

      I'm just glad it isn't retina scanning. Ouch!

      --

      Life is the leading cause of death in America.
    3. Re:Remember your friends by accelleron · · Score: 3, Insightful

      "The scanner only stores a tiny amount of data for each fingerprint, just enough to ensure an accurate match"

      Unless I'm an idiot, this means that the amount of data the scanner stores is inversely proportional to its accuracy. For example, if one were to store a critical 20% of the data neccessary to recreate a fingerprint, with use of the partials on the keyboard and the top of the laptop, one should be able to recreate the print accurately enough using means like a laser (3d) printer, a bit of spare rubber, and anything with a curved surface. Since the scanner is not 100% accurate, it would confirm, anyway.

      Besides, this laptop defeats its own purpose. How difficuilt would it be for someone to make a 1:1 image of the hard drive and decrypt it. Or, if you were pressed on time for the encryption, simply to pop the hood,remove the box, and emulate a 'success' signal with use of a relatively simple circuit, something one could construct in an hour with a soldering iron and proper documentation.

      All in all, this is a fun toy, but oh so useless.

      --
      Genius may have its limitations, but stupidity is not thus handicapped.
  3. hal by TedCheshireAcad · · Score: 5, Funny

    I tried one of these laptops for a while, took me weeks to get the thing to stop calling me Dave.

  4. Micron has biometric support by CyberSlugGump · · Score: 5, Informative


    Some models of Micron laptops have had this feature for a while.

  5. But... by Sensible+Clod · · Score: 5, Interesting

    will IBM include linux support?

    --

    The difference between spam and poop is that you don't have to dig through septic tanks looking for real food. -- Me
    1. Re:But... by temojen · · Score: 2, Informative
      Obviously flamebait as IBM is a major supporter of linux.

      And yet, the ThinkPad configurator (at least on their Canadian site) has options for Windows XP Home or Professional, but no Linux distributions (nor BSD) and no "no operating system" option.

  6. IBM is pretty cool by zoloto · · Score: 2, Insightful

    I was just at their website configuring a laptop for a business purchace. While I have to say their range of laptops are pretty slick their UI designer should be shot.

    Back on topic now, this laptop is nifty in itself. EArlier on another /. article, the hordes were in an uproar about the data security module in laptops. After seeing one on the website and with technical information, both the prior articles mentioning and this new biometric feature are for the purpose of protecting the users data from theft and not for "corporations" protection against "us". It wasn't engineered that way. Maybe in a few years that will happen, but to appease the paranoid crowd here - this is _FOR_ us. not against.

    =) happy /.ing

  7. Safe... but from whom? by Tackhead · · Score: 5, Interesting

    If they designed it in such a way that the LEA backdoor is secure (say, it's got an LEA public key on it, and the private key is kept in the forensics labs), I'll buy one tomorrow. I don't have a need to defend against .gov adversaries - I just want to know that the data on my drives remains secure even after someone steals 'em to get his or her crack fix.

    If, however, they designed it in such a way that the backdoor is not secure (say, a default password stored in cleartext on a serial EEPROM), that's another story. I'll download the crack when it comes out next week, and my soldering iron and I will have an endless supply of cheap entertainment when the machines start showing up at the surplus stores in 2009.

  8. Yes, but... by ProudClod · · Score: 4, Insightful

    Can it be fooled simply and easily by a piece of jelly, like most fingerprint scanners on the market. Surely you can drag the jelly across.

    --
    Gamers Europe - Gaming News. Reviews.
    1. Re:Yes, but... by Anne+Thwacks · · Score: 2, Informative

      Probably not ... the I-paq one allegedy uses the thermal imprint and not optical, so you would need jelly with suitable infrastructure of arteries and veins.

      --
      Sent from my ASR33 using ASCII
    2. Re:Yes, but... by HalfStarted · · Score: 2, Informative

      Even if it can... it is not totally useless. Strong authentication theory basically says for an authentication method to really be strong it has to be comprised of two parts: something you have, and something you know.

      Biometric measurements are attractive candidates for the "something you have" part because they are unique, in most cases easy to read and convenient... i.e. never left behind. On there own though they do not provide a strong authentication solution... but even then, a large bit-length key on a USB or serial device does not provide strong authentication on its own as the key can always be stolen or compromised.

      A finger print tied to a password on the other hand renders the entire system much, much more secure. It is up for debate if this is more secure in general than a key/password solution though... the trade off is something that is easier to use, more convenient for the user in hopes that it is used and used correctly vs a solution that is inherently stronger but more cumbersome for the user and more likely to be abused (leaving the key plugged in all the time for instance).


      Comparing fingerprints to a USB key as a solution to the "something you have" challenge in a security response:

      Fingerprint:

      + Impractical to steal
      + Always with you
      + Standard format
      - Relatively easy to forge for optical scanners
      - May change over time

      USB Key:

      + Hard to forge
      + Stable format
      - Not always on hand, could be left behind, lost, forgotten
      - Can be stolen
      - More difficult to provide a standard interface

      One of the reasons I personally favor keys, while they can be stolen the effort required to secure a key based token is much easier than the effort required to prevent leaving fingerprints around (unless you want to start wearing gloves all the time). Also if your key based token is stolen (or lost) you know it is gone, until you detect a break-in after the fact you will not know if a print has been forged... you would probably be aware if someone stole a print by removing a finger though ;)

      In my own (non-expert opinion) I would rank various authentication techniques as follows from most secure to least:


      Long bit-length token + Strong Password
      Strong Biometric measurement + Strong Password
      Weak Biometric measurement + Strong Password
      Long bit-length token
      Strong Biometric measurement
      Strong Password
      Weak Biometric measurement

      Not going even bother including weak passwords and not counting improper use/storage of tokens and devices (I consider weak passwords improper use btw). Weak Biometric measurements would be something like optical scanning, strong measurements are stuff like eye prints and thermal scanning/imaging.

      --


      Have you thought for yourself today?
  9. Can't Access My Computer Please Help!!! by PetoskeyGuy · · Score: 4, Funny

    I can't wait to see all the support websites.

    "Cut my finger slicing tomoatoes, can't access my Thinkpad, HELP!!"

    1. Re:Can't Access My Computer Please Help!!! by jormurgandr · · Score: 4, Informative

      That would be the reason why it allows you to store multiple profiles, and actively encourages users to store more than one finger, and on more than one hand (just look at the screenshots).

  10. But what happens... by DHalcyon · · Score: 2, Insightful

    When I break my Finger? I need my files, you know...

    1. Re:But what happens... by mobby_6kl · · Score: 3, Informative

      You can set it up to use more than one finger, so if you break one you can use the one on the other hand, in case all fingers on the first hand are broken/cut off/missing.

    2. Re:But what happens... by dr_dank · · Score: 2, Insightful

      When I break my Finger? I need my files, you know...

      Sounds like a good pretense for Social Engineering ones way into such a system.

      --
      Where does the school board find them and why do they keep sending them to ME?
  11. The Mafia loves it already! by Schreckgestalt · · Score: 5, Funny

    Now the Mafia have finally got another reason to cut your fingers off! And they can shoot you before you talk, as you don't have to talk.

  12. I realize IBM is a mainstream notebook company... by Infinite93 · · Score: 4, Informative
    But Motorola has sold a laptop with this for law enforcement for over a year now.

    http://ruggedpower.motorola.com/ Our local PD has them for detectives. Heavy, but nice feature set.

  13. Hype Factor 9 by cynic10508 · · Score: 4, Informative

    For an IT manager, biometric security will make life much easier. Gone will be all those phone calls from users who've forgotten their passwords. And there will be no more worries about insecure passwords, or even keystroke loggers, trapping passwords and passing them onto hackers and fraudsters.

    Gone may be phone calls for forgotten passwords but there'll be plenty of new calls as to why their fingerprints aren't scanning. The function of accuracy for fingerprint scanners varies according to things such as the skin's elasticity. This changes with age, humidity, cuts, etc. So biometrics aren't a 100% fix. There will always be "goats," the people for whom biometrics just doesn't work well, including the biometrics professor around here who's missing a fingertips (not due to any experiment mishap, mind you). I'd also worry about the security of your stored biometric data. Hopefully it'd be a hash and not the raw data, which could be harvested and used. Then again, I wonder what the incidence of collisions in a hash that uses biometric data is?

    1. Re:Hype Factor 9 by lesinator · · Score: 3, Informative

      Not only easier, but also more secure. A common username and password is only 1-factor authentication (they're both something you can know). Using a username and biometric is 2-factor authentication (in this case, someting you are and something you know). For 3 factor authentication you need to cover: something you know, something you have, and something you are.

      Biometrics stored for authentication are stored in a reduced, non-reversable format. Its designed to be searched and matched, but not extracted.

      L

  14. False security by GraWil · · Score: 4, Insightful
    This is nothing more than false security for pointy haired induhviduals. A clueful cracker with console access can usually get access to data. If the laptop is stolen, so is the data and no fingerprint widget will prevent it.
    But what makes SafeGuard Easy so special is that it works with IBM's own Rescue and Recovery utility. The problem with encrypted data is that when you try to restore an image of an encrypted hard drive, all the data, including the boot records just look like garbage to the restore program. But with SafeGuard Easy, you can keep the entire contents of your drive encrypted, and still be safe in the knowledge that should your hard disk crash, you can restore all your data to a new drive despite the fact that it's encrypted.
    Has anyone here used or admined IBM's lotus notes? I feel real good about trusting IBM with my encrypted HD.
    1. Re:False security by browncs · · Score: 3, Informative
      Has anyone here used or admined IBM's lotus notes? I feel real good about trusting IBM with my encrypted HD.

      Are you aware that:

      • Lotus Notes had the first commercial implementation of a Public Key Infrastructure (PKI), and it's still by far the largest commercial deployment of a PKI.
      • Lotus Notes has never had a security incident where a virus or worm successfully attacked it via Notes native interfaces or e-mail. (There have been some security patches required in the Internet-compatible interfaces.)
    2. Re:False security by darkwhite · · Score: 3, Informative

      A clueful cracker with console access can usually get access to data. If the laptop is stolen, so is the data

      RTFM.

      Do you know how password protection and data encryption works on laptops? No, you don't.

      There are several layers of security involved. First, the BIOS and the HDD both have password authentication mechanism. The BIOS stores its passwords on a custom chip which scrambles its I/O. Resetting the BIOS master password is possible, but it requires a highly modified chip programmator and a skillful person.

      The HDD stores its password on the platter and requires it before it will allow access to any data. To bypass this mechanism, you must engineer your own HDD controller chip which will skip the authentication and the PCB for it and transplant it in place of the one on the HDD. This is virtually impossible unless you have very good friends in the HDD manufacturer company.

      Finally, after the HDD allows access, the software encrypts selected files using strong encryption and stores the keys on the secure (TCPA) chip. The secure chip requires a passphrase before it will allow access to the keystore. It is virtually impossible to bypass this and retrieve the keys from the secure chip without knowing the passphrase.

      Therefore, to retrieve the data from the stolen laptop's HDD, you must first possess either extreme competence in electronics or extremely good illicit connections in the industry, and second, brute-force industrial-strength encryption on the files. Good luck.

      --

      [an error occurred while processing this directive]
  15. Notebook Nirvana... by NetJunkie · · Score: 2, Interesting

    I love my Thinkpad. I had a T30 before that stayed on 24/7 for over a year. The only time it was turned off was to/from vacation. The rest of the time it was a workhorse. Now I have a T42P and love it as much or more. Functional and VERY stable. Sure, it doesn't have some super new gizmos like others, but it works every time.

    Every time someone asks me about a notebook I recommend IBM. They go out to Best Buy and get some other brand with 20 other options they don't need and then get mad when it breaks or isn't stable. Thanks IBM!

  16. Are genitals unique? by Anonymous Coward · · Score: 2, Funny

    "Please push your scrotum on the biometric sensor to login."

  17. I feel sorry for someone who loses a finger. by CyberLord+Seven · · Score: 4, Interesting
    This is cool though. I like how IBM put the fingerprint ID tech in front of Windows. That means Linux based OSs can also take advantage of this when these machines are being sold as refurbished in a few years.

    I'm a little disappointed that the encryption stuff may not transfer well to non-Windows OSs.

    Now what happens when someones finger is damaged to due fire, electrical shock, or blunt trauma? I had this problem with an old Compaq laptop that had a system password at the BIOS level. It made the laptop permanently mine since I didn't want to disclose my password to anyone else.

    I know there's room for 21 different fingerprints, but I wonder how many end users are going to think to register more than one of their fingers...just in case.

    --
    We have always been at war with Eurasia!
    1. Re:I feel sorry for someone who loses a finger. by BeBoxer · · Score: 2, Funny

      I know there's room for 21 different fingerprints, but I wonder how many end users are going to think to register more than one of their fingers...just in case.

      21 fingerprint slots, eh? That's enough for all my fingers and all my toes with one leftover. What's the 21st one for?

  18. If you don't want an IBM... by IronChefMorimoto · · Score: 2, Informative

    If you don't want an IBM Thinkpad for the fingerprint scanner, the APC fingerprint scanner/biometric reader seems to work pretty well. I saw it for $29 or so at Fry's yesterday.

    My friend bought one a while back and used it rather successfully on his Dell D800 before he had to give the computer back to his employer. It was pretty accurate in scanning his fingerprint. He never got locked out of his machine.

    I can't remember if the machine would NOT allow a login without the reader or not. If it would, then that sort of defeats the purpose of the reader if you were able to steal the laptop without the reader attached.

    IronChefMorimoto

  19. Good for security, annoying for everything else by dreadfire · · Score: 2, Insightful

    In theory and from what I have read on the article, it will be a great device for security. But I don't think people will really realize how annoying this feature will become. If it gets damaged, no more using computer. If you get a nice little scare on the finger you choose to scan, no more using comptuer (unless of course you add more than one finger, but still). I guess this is one of those things that the government should use, I don't know how easy or useful it would be used for a personal use computer.

  20. Re:A bit of false security. by avalys · · Score: 2, Interesting

    Under threat of physical violence, most security systems that involve humans tend to break down.

    I'd give up my PGP private key to someone who put a gun to my head - that doesn't mean that PGP itself is insecure.

    --
    This space intentionally left blank.
  21. Student's Thesis makes this feature useless! by xanthines-R-yummy · · Score: 2, Interesting
    A la this article.

    I didn't RTFA, admittedly, but did IBM take her results into consideration before designing/implementing this feature?

  22. Re:fingerprints are everywhere by over_exposed · · Score: 2, Informative

    How the hell does you mind work? ANYONE can steal a laptop. I've seen a 13 year old in an airport try to walk away with one and you're saying that a 13 year old kid could reproduce my fingerprint accurately enough for a scanner to read it? Shut up and read the articles. Maybe even google the technology in the article so you can comment on it intelligently...

    --
    "The object of war is not to die for your country, but to make the other bastard die for his." - Patton
  23. Limited Credential Revocation by Aumaden · · Score: 2, Interesting
    Never use biometrics to control access to critical data. Barring such silliness as using toeprints, biometrics allows you 10 credentials (or only 2 is using full palm prints).

    If your RSA key is compromised, you can just generate another. You can do this as often as necessary. However, if you fingerprint is compromised, all you can do is switch fingers. Nine compromises later, you're SOL.

    Now for ordinary folks who just use this to keep others from messing with their laptops, this isn't an issue. However, if security is critical, biometrics just won't cut it.

    And, yes it's fairly easy to fool a finger print scanner. All it takes is some Krazy glue and a Gummi bear.

  24. Made for Men Only? by mykepredko · · Score: 2, Funny

    I know it's lame, but the first thing that came to my mind when I read the number of prints that could be stored in the laptop was that women don't have the 21 "digits" that men do...

    Weird on a Monday,

    myke

    --
    Mimetics Inc. Twitter
  25. So many critics... by nunley · · Score: 4, Insightful

    I am the guy they quoted in the original press release. I have one of these babies in my hands and let me tell you... pretty cool stuff.

    My 2 cents...

    The fingerprint reader is of a type that has not been 'fooled' yet. Yes, contact readers are easy to fool. This is not a contact reader. It reads the capacitive properties of the ridges and valleys that make up your finger print. This is actually quite cool since a severed finger does not have the same capacitive properties, and the reading is of live tissue *under* the skin, not your dead skin at the surface. So, a minor injury isn't going to be a big deal and the mafia cannot cut your finger off and use it. Furthermore, the extra small footprint of the reader is nice because there is less opportunity to damage the reader with scratches.

    The idea is to register more than one finger and fingers from both hands. Of course, nothing is foolproof, but the idea here was to include a low cost yet effective way to provide biometric access control to the laptop. The embedded security system (ESS) protects a lot of things including a password vault. Password vaults have their drawbacks, the most obvious of which is if you have the 'master' password, you now have *all* of the passwords that user has stored in the vault. Average users tend to use simple master passwords, making the password vault a huge risk. This is a way to provide the functional equivalent of a strong password to unlock the vault without making the user have to remember a complicated password or some hardware key.

    I am very impressed with the entire package. I think it will make it much simpler for IT to deploy things like ESS without destroying all of the value in ESS because users choose crappy passwords. There are a number of add-ons that make it very appropriate for enterprise deployment, including centralized key storage and disaster recovery software.

    My biggest problem to date with this kind of software was it hasn't been real reliable in the recovery category. I could make it very secure, but God help me if I had a hard drive crash or an OS go belly up. The 'backups' of this data were often times 'too secure' to be recovered. This latest package of hardware/software has many of the previous holes filled in and I am happy to report success in all of the tests I have conducted so far.

    Of course, anybody can implement this poorly. However, IBM has done a stellar job with it this time. I feel privileged to get to play with stuff like this.

    -Shawn

  26. copycat by oneishy · · Score: 2, Interesting
    . The latest machines will also include some pretty cool encryption software, that will keep your hard disk safe, but still let you backup and restore images.

    How is this different than apples FileVault feature in OSX which uses 128bit AES encription on your home directory?

    I have a powerbook and I must say that the FileVault works beautifully (and seamlessly)

    It used to be Microsoft copying Apple, but I guess IBM can do it to. Granted my powerbook doesn't use a fingerprint as the encryption key.. but still.

  27. A funny story about this... by sczimme · · Score: 2, Interesting


    There was an interview in Business 2.0 a couple years ago with an individual who claimed she had had a very similar problem: she had just finished a presentation for a conference; the weekend before the conference she had a mishap in the kitchen and burned her finger, so she couldn't use the biometric authentication mechanism on her laptop. Her solution? She got on a plane and went to see her twin sister in Florida. She actually claimed in the article that "twins have identical fingerprints" and her sister was able to log in to her laptop for her and save the day.

    The huge, glaring flaw in this scenario is that even identical twins will have fingerprints that look as much alike as the fingerprints of two random strangers on the street. The interview was good for a laugh, but sadly it does not appear to be available on the Business 2.0 site any more.

    The individual was Bondra Bchneider, where B==S. She also referred to binary 1010 as "ten-ten"...

    --
    I want to drag this out as long as possible. Bring me my protractor.
  28. Re:I'm sorry, but you're an idiot. by cHALiTO · · Score: 2, Interesting

    Both wrong. The data stored is usually some kind of array or matrix of the finger minutiae (relative position, direction, etc). No serious fingerprint identification system compares -images-. Te image of the fingerprint is analyzed, the minutiae are extracted, and that's used to perform the matching against the database. A single fingerprint can contain more than 50 minutiae, while 12 are enough to identify a person.

    --
    "Luck is my middle name," said Rincewind, indistinctly. "Mind you, my first name is Bad." -- Terry Pratchett
  29. Insecure? by Kent+Recal · · Score: 2, Interesting

    This article from 2002 claims that most fingerprint readers available to joe user by that time were easy to fool. Easy as in: press a plastic bag filled with warm water on it to replay the last print.
    Are we looking at a new, better generation of readers today or are they still as insecure as they used to be?

  30. Re:the fujitsu lifebook P7010 already has fp scann by praxis · · Score: 2, Informative

    Also, the Electrovaya Scribbler SC800 and Electrovaya Scribbler SC2100 have finger print scanners as well. [1] They've had them for years. I guess they are just becomming more mainstream.

    http://www.electrovaya.com/product/scribbler_pro du ct.html