Slashdot Mirror
Fingerprint Recognition with Linux & IBM's T42
Michael R. Crusoe writes "UPEK, provider of popular fingerprint sensors to IBM's T42 notebooks and others, has announced that they will be providing a BioAPI compliant library to perform biometric authentication under GNU/Linux. Will Linux be the first operating system to have integrated biometric user authentication 'out of the box'?"
I don't understand this. Isn't writing to PAM all you need to do to support authentication on Linux?
They're talking about writing this whole framework for Linux called BioAPI, and then once that's done they're going to work on a BioAPI-to-PAM gateway, but that seems like way too much work.
Why can't an authentication module simply maintain its own database to register the biometric data associated with each user?
The way it is now, pam_unix.so does a one-way hash of the password you create and compares it with a one-way hash of whatever password you enter to log on, right? The password once stored is never stored in the clear.
I get the fact that you can't do that with biometric data because the data never is exactly the same, i.e., the one-way hash of the fingerprint you use to create the account won't be the same as the one-way hash created as you log on. And to do the comparison otherwise you'd need to load the data into memory, which is like loading a password, which is bad.
This is a really tricky problem.
I just don't see why we need a new framework. Seems to me, we need a new kind of hash function.
Why can't that go into pam_finger.so?
Wow, I am really looking forward to giving Linux the finger...er wait..
AT&ROFLMAO
Put now your finger on the scanner to play this drm-protected wma. Well... kinda better than hardware fingerprinting anyway. But way more spooky.
\u262D = \u5350
Windows has supported biometric authentication (in addition to smart cards) since Win2k. Hell, they've been selling keyboards with fingerprint scanners built in for almost a year now ...
I think it's great - and time! I really don't like having to remember 20 or so passwords just so because if one of them gets hacked my other data is secure. :(
Non-supporter of Online Activation and any other draconian DRM
Linux frequently supports a lot of hardware out of the box. Some folks argue that there is better hardware support for Windows. And that is true in and of itself. However, how often when installing a Windows operating system do yo need a load of driver CDs to accompany the installation? In my experience: always, especially if there is additional hardware such as a printer. Linux, on the other, is frequently distributed with drivers for suppoorted hardware out of the box. What's better is that as Linux grows in popularity, so will the hardware support.
Get some.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
The combination of open sores and a finger scanner doesn't sound too hygenic to me.
I guess if I had a fingerprint scanner I'd want to clean it regularly if people are going to start trying to use it randomly...
I am reminded that when I was reading Stallman's The Right To Read (linked from the recent Slashdot story Old-Fashioned DRM Protects Harry Potter Book), I wondered why it didn't include biometrics. That would have prevented the happy ending.
Having biometrics on my computer with a free / open source OS wouldn't be scary like having biometrics on my computer with a closed OS and hardware DRM, of course.
For public / institutional networks though, I can't help but wonder where it's going. But on the plus side, at least if big brother runs on Linux I won't worry so much about script kiddies stealing my identity.
...what I want is retinal scanning!
I'd imagine the patterns in our eyes are more difficult to duplicate for nefarious purposes than our fingerprints, which (besides the cool factor) would mean increased security... On the other hand, I'd rather have the arch-villain chop off my finger than carve out my eyeball.
Except you couldn't switch to using only biometric authentication (not until they get a little DNA blood pinprick scanner thingy, anyway), so the best place for biometric authentication is as an added layer of protection on top of the 20 regularly-rotated random passwords stored in your brain.
Yes, my tin foil hat fits very nicely thankyouverymuch.
OK, so the Merc was worth USD 75,000 to the thieves, a little more than a laptop. But if a dead finger works, a plastic replica would work as well. Before using a system like this, it may be worth considering the value that the data on a laptop might have to unscrupulous rivals ...
Is it worth this kind of horror to protect the laptop itself? There are easier and better ways to protect *data*.
How on earth do I change my login data once it has been compromised? How do I randomly regrow a new fingerprint? Or retina?
At least you can change them.
r s_defeat_fingerprint_sensors/
http://www.theregister.co.uk/2002/05/16/gummi_bea
My boss has one of those Microsoft keyboards with the fingerprint scanner. It does not work for Windows logins, only for things like passwords on webpages.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 Whoops, silly middle mouse button...
It's about the same as the state for speech recognition elsewhere. The systems use way too little data to actually analyze and get at best a 95% or so recognition of the acutal user, and the sensor acuity to defeat even the fake gelatin fingers (Google keyword: gummi fingers) is simply not there, since with a fake finger made from a fingerprint lifted from elsewhere the class that did the Gummi fingers still got better than 80% recognition.
Basically, the ability to detect a fake fingerprint with a casual test has never existed. The sensors just aren't good enough, even if the software authors were willing to invest the resources to store really thorough images of fingerprints, which they're not.
When configuring the system, you provide original prints from any number of your fingers. It suggests you provide 2 of them. Then, you just have to slowly pass any of the fingers on the sensor for it to authenticate you. So for instance, you could make sure you have an electronic print of your right index finger and of your left ring finger. I suppose the redundancy is meant to make sure you have a back-up the day you nicked you finger doing DIY during the week-end.
If you want to change the print (the same way as you would change password), you just remove some existing prints from the authentication DB and replace them with new ones. Then you just have to remember what finger to use this week.
Finally, there is always the solution to press CTRL-ATL-DEL to get a normal password prompt.
So, all in all, the way it is implemented in Windows is not as a substitute to the standard password authentication but as an extension that makes it easier for you, the owner of the machine, to log in but not more difficult for a third party to do so.
I quite like the way it's implemented on Windows but it would be nice if its use could be extended to provide digital signatures and authentication to other systems, such as a Firefox plug-in.
I forgot to mention: the Windows XP implementation doesn't come out of the box. It's an IBM extension that is provided with the T42.
Unfortunately, fingerprint authentication does NOT satisfy government requirements (not to mention the inherent insecurity should you ever be prosecuted).
CFR 21 part 11 (Code of Federal Regulations governing electronic signatures) mandates that you have to have at least 2 out of 3 things to be said to have securely authenticated:
If any system is compromised, and 2 out of the 3 above are used, then there is a conspiracy (like you gave your keycard and password to someone else).
The issue about security when prosecuted, is that your physical body (fingerprints as well) are subject to "search and seizure" if you are ever arrested (even if 100% innocent). There was a case that went to the Supreme Court (which I can't recall the name of) where a man argued that his fingerprints were "property", and until he waived his rights to his property, he could not be fingerprinted. I'm not sure how that turned out though.
Basically if you're arrested and they fingerprint you, they could just as easily scan in your fingerprints electronically and "replay" those back later to gain access to your biometric laptop or other devices.
Best to use 2 out of the 3 (or 3 out of the 3) above, so they can't gain access to your protected data without your approval or consent.
The FingerChip(tm) has been doing exactly this since about 1998 or earlier (that's 7+ years). The FingerChip is about 1mm x 8mm in size (about 1/2" long, about the width of a wooden matchstick). I think the company sold its technology to someone else now over the years, but lots of companies are using it... including IBM.
I was investigating their scanners back in 1998 when I was doing biometric authentication on wireless tablets running Citrix Metaframe for $BIG_PHARMA. This was back in 1998!! Technology has, of course, improved considerably since then.
Basically you swipe your finger across the FingerChip and at least 52 separate datapoints are gathered, which include speed of the swipe, pressure, heat, and of course the standard whoops and swirls of your fingerprint itself. We tried using lifting techniques and other things on it (as did the manufacturer), and it was simply not possible.
It is similar to trying to forge a signature. Sure you can forge it so the end result looks identical, but did you press your pen with the same pressure? Did you dot your "I" before you finished the word, or after? Did you cross your "T" from left to right, or right to left?
Any biometric scanner that doesn't measure these kinds of things shouldn't be used.
Incidentally, we tried lots of different kinds of scanners, including voice. The voice biometric scanners had about a 90% failure rate in our tests. I could log in as my colleague, just by repeating his exact intonation and speed... I could not, of course, imitate his fingerprint.
I have had a Digital Persona Biometric Fingerprint scanner that I have been trying to get working for ages now. It works great in Windows, but I havent yet found a program to get it to actually perform in Linux. It is USB, and does get identified by hotplug. Digital Persona does provide an SDK for their devices. My opinion is Biometric authentication will be a pretty regular standard in the future.
Am I the only one thinking outside of the shoe? We leave fingerprints all over the place -- drinking glass, doornobs, eyeglasses. When they create a device that you can stick your foot in for authentication.
ewe sorry, this is going in the wrong direction.
Having to work for a living is the root of all evil.
Those who think biometrics are better than password systems, ought to think twice. While passwords can be changed when compromised, biometrics cannot.
There is a scene in a James Bond movie where JB uses a glass eyeball that has someone's retina pattern in it to gain access to a secure building. Also, all biometrics must be converted to some digital pattern. How long will it be before some malicious person gets these digital patterns and figures out how to plug them into the software that authenticates the biometrics thereby bypassing the reader?
Once compromised, you can't change your fingerprint or retina!
"You know, you've gotta watch it with those circular saws," Tom said off-handedly.