Toshiba Puts Fingerprint Readers on Cell Phones

An anonymous reader writes "As if it wasn't enough to have fingerprint scanners on laptops, Toshiba has put them on two of its latest smart phones. The Toshiba G500 and G900 feature fingerprint scanners on the back of the handsets, allowing users to access their phone by simply sliding their finger over the scanner. This is supposed to provide a better level of security than using a code of some sort. Of course it also means that someone is more likely to chop your hand off if they desperately want your data."

Comments

I'd slide it a finger allright...

[Zapotek]

The Toshiba G500 and G900 feature fingerprint scanners on the back of the handsets, allowing users to access their phone by simply sliding their finger over the scanner.

...and that would be the middle one.

IMHO it's far more complex than necessary, more cool features == more things waiting to fail.

Re:I'd slide it a finger allright...

[The Clockwork Troll]

Not to mention that this kind of auth is at best inconvenient (at worst, dangerous) in a hands-free situation such as driving.

Re:I'd slide it a finger allright...

[sonicleads]

How is it any worse than entering a PIN? You'd just authenticate before you started driving. The only (realistic) way I can think of authenticating hands-free while driving would be voice, and I don't think it's quite there yet. I can't see some businessman doing 95 while screaming "Unlock!" at his phone repeatedly being much safer.

Re:I'd slide it a finger allright...

[SimonInOz]

I have one of these Toshibas. The fingerprint scan works mostly - but it doesn't work very well if you are cold (maybe it thinks you are dead ... how would Spike [a vampire - info for those foolish few who don't follow Buffy] operate one of these?)
Also the software for handling the login process is pretty sucky - it's hard to handle the mail server which tends to come up with different names, etc etc. I eventually disabled it for all except the main login, which works well enough to cope with. I have done better than most - who have given in.

On a phone, it could be a pain - but at least it has to do only one thing. Entering a six digit password (as I must on my corporate Blackberry) is *very* painful, though, and a fingerprint scan would defintely be better than that.

Re:I'd slide it a finger allright...

[ronanbear]

Right, so if I were to become an undead vampire I wouldn't be able to access my contacts list on the phone anymore? Bummer (not so much for them, though).

What about flesh eating zombies?

Re:I'd slide it a finger allright...

[Heian-794]

The fingerprint scan works mostly - but it doesn't work very well if you are cold

Another problem just occurred to me: in winter, people will have to take their gloves off just to make phone calls outdoors!

I realize that people in the US spend a lot of time driving, but people also make a lot of calls when outdoors waiting for people to meet them, etc.

Or will global warming soon become so intense that we won't have to worry about outdoor gloves anymore? ^_^;

Re:I'd slide it a finger allright...

[Cheetahfeathers]

Driving needs too be a phone free situation, hands free phone or not. Studies on the subject have shown that hands free phones are little better for driving than a hand held unit. http://www.livescience.com/humanbiology/060629_cel l_phones.html

Re:I'd slide it a finger allright...

[HairyCanary]

If we ban hands free cell phones in cars, we might as well ban passengers too. And kids. At some point we just have to accept that personal responsibility needs to play a larger role than law.

Re:I'd slide it a finger allright...

[encoderer]

This is long past due. I'm very liberal but I also think that a government shouldn't make laws that encroach personal freedom unless it's something that's affecting the personal freedoms of others.

I used to use my cell while driving and I used to balk at the idea of legislating it.

But over the past 5 years--as cell phones have exploded--I have noticed a remarkable correlation between drivers that, as i approach them, I think "what the fuck is this guy doing?" and, as I pass them, I notice they're using the cell phone.

This phenomena manifests itself in 3 basic ways:

1. A left-lane-Roadblock who's moving nicely along takes a call and, within the first minute or two, slows from 10+ MPH over the limit down to the limit or even BELOW the limit, without necessarily realizing it, getting over, or noticing the line of pissed off people behind him.

2. The Last-Minute-Switcher that, despite being a lifelong resident, drives like a tourist. He realizes at the last possible second that he needs to cross 5 lines of traffic and exit.

3. The Pace-Car, very similar to the Left-Lane-Roadblock, except the Pace Car Driver can be in any lane and, sometimes, more than one lane at a given time.

Re:I'd slide it a finger allright...

[HBI]

All of these are real and i've seen them all.

The problem isn't really the cell phone, the problem is the inability of the majority of the population to focus on more than one task at once. There is no cure. I'm pretty convinced that people are just lacking in this talent and as long as we provide 'something else' to do in the car, we're still going to have to watch out for them as if they were drunk drivers.

Invariably, some politician will 'correct' the problem by restricting *my* right to use a phone.

Re:I'd slide it a finger allright...

[Foerstner]

Putting aside the fact that passengers, child or adult, are an integral part of travel, whereas cell phones are not, there is a clear distinction between cell phones and other distractions (passengers, radios, makeup, a latte or a Double Whopper with Cheese)

Cell Phones demand immediate and constant attention.

In-car passengers shut up when they notice that the driver is trying to merge onto the interstate, or make a turn across the oncoming lane. It's automatic. Similarly, drivers don't generally do other things while performing difficult driving tasks.

Cell phones, however, don't lend themselves to being ignored or put down while a driver is doing something important. In this, they're unique among driving distractions (except, perhaps, for a steaming hot latte that you just spilled on your crotch.)

Re:I'd slide it a finger allright...

[nospam007]

It will be forbidden sooner or later everywhere, just like DUI.
http://www.cellular-news.com/car_bans/

Re:I'd slide it a finger allright...

[Dravik]

In-car passengers shut up when they notice that the driver is trying to merge onto the interstate, or make a turn across the oncoming lane. It's automatic You must not have many women riding in your car. You seem to have forgotten the unending female pay attention to me trick where she points in a random direction and says "look at (random object well outside viewing distance) what do you think of it?"

Re:I'd slide it a finger allright...

[SimonInOz]

>> she points in a random direction and says "look at (random object well outside viewing distance) what do you think of it?"

This is because women have far superiour peripheral vison to men. (That's why they can find things in the fridge and you can't).

They really ought to be far better drivers than men - but they aren't, are they? Slightly, perhaps, according to insurance companies.

Maybe they keep getting distracted. Possibly by their passengers.
Or their cellphones.

Re:I'd slide it a finger allright...

[trianglman]

In-car passengers shut up when they notice that the driver is trying to merge onto the interstate, or make a turn across the oncoming lane. It's automatic. ... Cell phones, however, don't lend themselves to being ignored or put down while a driver is doing something important.

I don't know about your experience, but in my experience with a two and a half year old, compared to most cell phone conversations, most people I am on the phone with are more amiable to me setting the phone down for a minute than my son is to ignoring him for a moment. Now, that said, this still requires personal responsibility on the driver's part to tell his/her conversant to hold for a moment, but it isn't impossible, nor even difficult to do.

Re:I'd slide it a finger allright...

[Anonymous Coward]

They really ought to be far better drivers than men - but they aren't, are they? Slightly, perhaps, according to insurance companies.

Well, there are two factors here: driving skill, and driving safety. Men are much more skilled drivers than women. They tend to be better at maintaining a constant speed, judging distances, and merging into traffic. However, women are much safer drivers than men. On average, they drive less aggressively and take fewer risks (maybe because they know they're not as good at it, while men overestimate their better skills?). Women cause fewer accidents this way, so the insurance companies like them better.

If it wasn't ...

[FIT_Entry1]

Of course it also means that someone is more likely to chop your hand off if they desperately want your data

... for the fact that I was reading this on /. I would just assume you were joking.

another feature to be crippled

[Anonymous Coward]

Those of us who live in northamerica probably won't get this feature, since our domestic carriers have a penchant for disabling features on "their" phones. Nokia E62 all over again...

Re:another feature to be crippled

[nkv]

What does "their" mean in this context? Where I am, we first get a connection and a SIM from a provider then go to a showroom and buy a phone from there (Nokia, Motorola whatever). Insert the SIM into the phone and start using it. The carrier and the handset are provided by different people. Isn't it the same way there in the US?

Re:another feature to be crippled

[jonwil]

You can either choose to buy a SIM and then a phone separately or you can go for a contract and get a phone that is cheaper than you would normally pay. However, the downside to the lock-in is that you may have features disabled (of course if you own a Motorola, you can use FLEX editing to enable the features again :)

Re:another feature to be crippled

[AnalogFile]

Where I live we also get the SIM from the carrier and the phone from the shops. Plus most carriers also sell you the phone, if you want to buy it from them (the phone comes conveniently set up to use with that specific carrier).

But I understand that most cell phones in the USA are locked to the carrier. The user does not own them. They rent it from the carrier as part of the contract. And they are locked into that carrier (that is they only work with that specific SIM).

This is counter intuitive, given that the USA have all the hipe in freedom, competition and anti trust. Fact is that for the cell phone market they are among the less liberal countries. Not only the phone handset market is mostly tied to the phone carrier market instead of being totally separated as it is in all europe and in most other countries, but even the contracts they commonly have use strongly anti competitive lock-in practices. Like binding you for a preset contract duration. This is explained with "setup costs". But fact is that those costs are actually minimal for the carrier (the handset, is the real cost).

Here I own my phone (or phones). And can mix and match SIM cards and handsets. It is actually pretty common when one is out of battery to just pull the SIM out of the phone and borrow a handset from a friend for just a single call (as long as she removes her SIM and I place mine in her phone, the cost of the call is mine and I'm only "consuming" her battery).

Also I can get a new phone number and SIM for as low as a dozen euros (one euro is just a bit more than a dollar), and it includes anywere between 70% and 100% of the price in prepaid traffic (depends on the current promotions). There's no tie-in: i can give up the number any time.

Traffic is actually pre-paid. So the only tie-in is the amount of pre-paid traffic I put in the SIM at any given time. I personally tend to pre-pay in 50 euros chunks. But I know people that only reload 8 or 10 euros at a time. A couple of years ago I was abroad for 3 weeks and I knew I was going to place and receive several calls to/from within that country. I figured that it yould be stupid to pay full international roaming fees. So I just purchased a SIM card for 8 euros and then reloaded it once with 10 extra euros or traffic. I spent 18 euros total and placed more than 15 euros worth of traffic. If I did that much traffic with international roaming fees it would have costed me trice or more.

Back on topic, here when the phone get stolen there's no problem with the traffic itself. I can lock-out the SIM in no time (just call the company, tell them your SIM was stolen with your phone and they'd disable the SIM in no time. Later, if you decide to stay with the same company you can have a replacement SIM for a small fee. It'll have the same number and also the remaining pre-paid credit. So what you actually do loose is the phone itself.

Would the fingerprinting be usefull? I'm not sure. There surely is some way to "reset" the phone. And the players in the stolen phone market will know how to do it even before the phones actually hits the shops. Therefore I'm not sure how much it'll protect you. It may be usefull if you want to "keep secrets" form friends/partners/coworkers. You could safely go to the bathroom and leave the phone on the table without them seeing your call history, your SMSs and stuff. But that's just as far as it can probably go.

Re:another feature to be crippled

[got2liv4him]

But I understand that most cell phones in the USA are locked to the carrier. The user does not own them. They rent it from the carrier as part of the contract. And they are locked into that carrier (that is they only work with that specific SIM). You understand wrong... we own the phone, we just own the contract as well. They are usually locked, but most carriers will unlock the phone once your contracts run out.

This is counter intuitive, given that the USA have all the hipe in freedom, competition and anti trust. Fact is that for the cell phone market they are among the less liberal countries. What hype are you talking about? What does that have to do with our cell phone system??? I am sorry if we don't have as good of a cell phone system as most of the rest of the world! You sound like most of the other kool-aid drinkers who blame the us for everything, even condemning our cell phones. Get a hobby, stop worrying about the US, and start worrying about how you are going to pay for all those socialized services you guys have when there are more older than younger over there.

(one euro is just a bit more than a dollar) Thanks for clearing that up. American are too stupid to know the difference in exchange.

Re:another feature to be crippled

[Overzeetop]

Some of the largest carriers in the US still use CDMA phones, which are tied to service by their IMEI number. They come preloaded with the carrier's software and they buy enough phones to get custom versions with many features restricted. Verizon is the 800lb gorilla in this arena, but I currently have US Cellular which is the same way (not for much longer, though). They routinely prevent all multimedia transfers though the usb interface, instead requiring that all such transfers occur over "the network", thus generating an additional revenue stream. Take a picture? $0.25 to transfer it. Want a ringtone? Buy from the company store or pay for the data transfer - just $9.99/mo plus per-kb pricing. In return, their customers get a "free" phone along with a 24 month commitment to a service plan that will likley run no less than $40. Bargain, huh?

Other players in the US market use gsm, and you can buy your phone and service separately. Here's the rub: you can go pay full price for your phone on the open market and buy just a sim, but you'll pay the same monthly (phone subsidy) fee that the guy next to is paying, and he got a $450 equipment discount in return for the next 24 months of his business. Most gsm providers don't lock their house-branded phones too much. BTW - that $450 is a max benefit - a $200 phone would just be "free" or you might get $25-$50 back as a rebate. The retail stores will only spot you about $175-$200, but the serious online merchants will also give you the $200-$250 contract kickback they get after you stay for 6 months. These phones are, however, "locked" to the carrier, though there seems to be many outlets for unlocking service. Also, it is legal for a phone owner (under contract or not) to unlock their own handset, but the law doesn't require the carrier to actually help in the unlocking process (i.e. they can't be compelled to unlock your phone, even if you request it).

Aside from the locking thing, there's really very little to complain about if you want a new phone. The discount is about $175, and if you want to break the contract (cancel before 2 years is up), you owe them $175 cancellation fee. This seems wrong if you're in, say, month 20, as you've already paid most of the money back through the monthly fees. Except that there is no drop in rate after 24 months, nor is there any lower rates if you bring your own phone. You may as well just get a new phone every two years. Brought to you by the country who views the whole world as disposable.

Re:another feature to be crippled

[AnalogFile]

But I understand that most cell phones in the USA are locked to the carrier. The user does not own them. They rent it from the carrier as part of the contract. And they are locked into that carrier (that is they only work with that specific SIM). You understand wrong... we own the phone, we just own the contract as well. They are usually locked, but most carriers will unlock the phone once your contracts run out.

I stand corrected, partially. So you do own the phone. Still you confirm that the phone is locked.

I'm not sure exactly how it works. When you say you own the phone do you mean you can buy the phone but not the connection? Or buy the connection but not the phone? How does the locking work? Does it start when you activate the connection with a given phone? If you have multiple phones can you swap the SIM out of one (for example when it gets broken or out of battery) and into another one? What about the opposite: can you have multiple SIMs and a single phone (like one number for work/daytime and another for personal/off time)?

This is counter intuitive, given that the USA have all the hipe in freedom, competition and anti trust. Fact is that for the cell phone market they are among the less liberal countries. What hype are you talking about? What does that have to do with our cell phone system??? I am sorry if we don't have as good of a cell phone system as most of the rest of the world! You sound like most of the other kool-aid drinkers who blame the us for everything, even condemning our cell phones. Get a hobby, stop worrying about the US, and start worrying about how you are going to pay for all those socialized services you guys have when there are more older than younger over there.

What? I did not mean to offend anyone! Maybe my english is not that good. I've just looked up "hype" and it is defined as "extravagant or intensive pubblicity or promotion". I did not intend it to imply the "extravagant" part of the dictionary definition. Maybe I would have expressed myself better by using "stress" or "prominence" or "importance" or something like that. Just wanted to say that freedom and competition are fundamental elements of the american culture/style (and if they are not, please do correct me). And despite this, the phone market is not handled liberally. I'm not condemning anything, just noting a fact. And I do not blame the US for everything as you say (are you trolling at me or are you just a bit too sensitive to something?). As for the problem of aging population, I do worry. But that is somewhat OT in this thread. Isn't it?

(one euro is just a bit more than a dollar) Thanks for clearing that up. American are too stupid to know the difference in exchange.

Are you overreacting again? What makes you think all readers here are americans? Did it ever occur to you that a lot of people around the world do have a strong perception of the value of a dollar and can say how much it is in their own currency, but do not know how much an euro is?

Speaking of fingerprints

[rogtioko]

In memory of the USS Maine.

Re:Speaking of fingerprints

[kfg]

In memory of the USS Maine.

Andorra must finally pay! America needs to show that it can still kick European butt for home security and morale. Break the Axis of the Completely Helpless!

But, ummmmmmmmm, be sure to disable the Q-Bomb first this time.

KFG

Better security?

[Niten]

Of course it also means that someone is more likely to chop your hand off if they desperately want your data.

More realistically, you'd also have to worry about somebody lifting your fingerprint from, say, the phone itself, then using that to log in. The MythBusters did a segment showing how easy it is to lift somebody's fingerprint, then use that print to defeat a scanner.

This thing isn't going to increase security, it's only going to increase convenience.

Re:Better security?

[sporkme]

You're absolutely right, but I would argue that it does not really even increase convenience. The last thing I need when my phone is ringing in a meeting, while driving, or at the dinner table is the horrific realization that I have forgotten to unlock the phone, and thus I must now meticulously subject myself to a fingerprint scan. Furthermore, many of us are negligent with proper care and handling of our cellphones. Until now that might result in a cracked outer screen or intermittently functioning button, but never in a total lock-out of an otherwise functional phone. So what happens when the reader is damaged? A hefty repair bill is what, and up to a month without that uber-vital super-secret data that just had to be protected with biometrics.

I have always felt that fingerprint scanning was ridiculous and cumbersome sci-fi, but real tests against this kind of security have shown that it is a waste of time and money. There is no replacement for properly managed and complicated password systems coupled with strong encryption. I regularly show friends and family how to create passwords that can be remembered but not guessed, and how to manage passwords that are outdated.

This reminds me of two prior /. stories. Bank employees merrily collected USB flashdrives that were scattered outside and proceeded to plug them into their terminals. Old cellphones purchased on eBay reveal secret data.

Re:Better security?

[MobileTatsu-NJG]

"This thing isn't going to increase security, it's only going to increase convenience."

Easy to defeat != no effect on security. Otherwise nobody'd lock their car doors. Afterall, it only takes a hammer to get in.

Re:Better security?

[thelamecamel]

A while back I was speaking to someone who was developing this sort of technology, who told me that his company (and presumably many others) don't look at the actual fingerprint visually, but probe slightly further into the finger. So fingerprint reproduction won't work on that technology, and he claimed that it could even tell whether the finger was connected to a body or not.

Re:Better security?

[Niten]

You're correct in that even this is better than no security at all. However, what I (and the summary) meant by "increase security" was security with respect to the traditional method of locking one's phone, which is with a PIN or a password of some kind. In that sense, this system will not increase security, as fingerprint authentication systems are demonstrably less secure than a well-chosen password.

Re:Better security?

[sporkme]

Doors locked < The Club < in the garage < leave some shotgun shells on the dash.
Fingerprint scanner < lock phone with PIN < lock phone with password < don't put secret data in an easily compromised system.

When it comes to security, this idea is both neat and worthless. And yes, when I go backpacking I leave some shotgun shells on the dash of my truck. All other things being equal, thieves will take the Prius.

Re:Better security?

[jrumney]

The last thing I need when my phone is ringing in a meeting, while driving, or at the dinner table is the horrific realization that I have forgotten to unlock the phone

On every phone I have seen, you can answer incoming calls when the phone is locked. What you can't do is make outgoing calls, or browse through the phonebook, calendar and other personal information on the phone. I don't see any reason why this would change just because the authentication technology changed from a PIN to a fingerprint.

Re:Better security?

[jrumney]

When biometric technology was new, it was expensive, and the only customers were military and other high security installations who are always looking for ways to increase the perception of security, if not the actual security. So technology to measure pulse, body temperature etc was built into the scanners from an early stage, to counter the sci-fi movie ideas of cutting off fingers, ripping out eyeballs etc to get around the biometric security.

More recently though, there has been a drive to cut costs and minaturize the scanners so they can be included in laptops and phones. I wouldn't be surprised if these scanners were susceptible to some of these basic attacks, perhaps even allowing access to 2D reproductions of a fingerprint, which is the most likely exploit to be tried.

Re:Better security?

[Anonymous Coward]

So what happens when the reader is damaged?

The same thing that happens when you assign a password to the phone and one of the buttons you need to enter the password stops working. You're screwed, but the designers try to make the sensor hard-wearing.

There is no replacement for properly managed and complicated password systems coupled with strong encryption.

Here's a scenario for you: Assume that you need to lock your phone. You then get a call and need to unlock your phone promptly in order to answer it. I propose that touching a fingerprint reader (requiring one press of your finger) would be quicker than entering any password longer than one character (requiring more than one press of your finger).

In other words, a 'complicated password system' would reduce usability, as well as being 'yet another password to remember'. Furthermore, GSM phones let you set a password but few people do; this may be because of this poor usability. If a more usable security system increases adoption, it increases security.

Why would one want to lock one's phone in the first place? Reasons include theft deterrence (no point stealing phones if all phones are locked), protection of personal data (previous calls list, text messages, photos, phone book), and to stop people making or receiving calls intended for you.

Re:Better security?

[Alioth]

Please turn your phone off in meetings or while at dinner - and especially while driving! The former are merely being polite, the latter is not killing a motorcyclist because you were distracted by your phone. Incidentally, the latter - using a handheld phone wile driving, carries a £1000 fine here.

Re:Better security?

[gavink42]

It might not be an increase in convenience. It probably isn't an increase in security. It's really an increase in consumer choice... and that's a good thing. Personally, I prefer entering a PIN to unlock my phone.

Depending on where the reader is, will determine how likely it is to be damaged. If it's inside of a flip phone, then it's probably safe. But because of the space required, it's more likely that it will be on the outside confronting keys and change in someone's pocket or purse. Hopefully, a phone with a fingerprint reader will *also* accept a PIN from the owner as a backup!

Re:Better security?

[wkk2]

If the fingerprint reader is damaged, just ask the cell phone provider to unlock or download the data. They probably wouldn't sell the phone without a back door (pin, puk, puk2, ...) :-(

On a related issue, does anyone make a mini-sd memory chip that can store pki certificates? I would really like to store my private key where it couldn't be extracted from my Nokia E61. This would reduce risks to only monitoring a "compromised" phone and maybe using it as a proxy. Bad guys could at least be kicked off if the phone is off line.

Re:Better security?

[mysidia]

I see... well, can it tell if the hand and arm that finger is on are still connected to anything? Anyone who could chop your finger off can probably just force you to unlock the phone anyways, then register their own fingerprint, and it'd be a much saner way of getting into your phone.

Re:Better security?

[Anonymous Coward]

Er... in American movies no one ever locks or unlocks car doors...

Re:Better security?

[Anonymous Coward]

then using that to log in

or to log in somewhere else... Or to implant false evidence on a crime-scene...

To counter this, some designer thinking he's very smart may decide to have the device 'read' the fingerprint without your finger touching the phone (picture a high-res picture of your finger taken by the device's built-in hi-res camera).

However, this still leaves another, way more dangerous, way to steal your finger print... By hacking the phone itself. Now we all know (uh, no, actually many don't) that fingerprint readers are not supposed to store your fingerprint but a one-way hash of it. Still, how much would you trust such a device? Especially knowing that at one point it had a picture of your finger?

Now some skilled dude anywhere on the globe can hack into your phone and retrieve your finger print.

As a rant, a famous scientist once said that biometric information, in court, should always only ever be used to prove that people are not guilty, not the other way round. For they're so easy to forge and for there are errors/duplicates, etc.

Sad, sad world... And dumbo designers thinking they're smart by implement Mission-Impossible-like gizmos.

Re:Better security?

[ngc3242]

As someone that works for a major fingerprint sensor manufacturer, I can say that the MythBusters did not select high quality sensors to test against. I'm getting a little tired of people who's entire pool of knowledge about fingerprint sensing is based on this one television making conclusions based on bad information. I'm not familiar with the door lock sensor specifically, but I can tell from observing it that it is an optical sensor. Whatever live tissue sensing that manufacturer claims to have is obviously not very good because the sensor was defeated with a moist picture of a fingerprint. The sensor they used on the computer I am familiar with, and it is about three years old. It is, however, based on a much better technology where flesh is live layer of skin is imaged using RF. Unfortunately, the sensor they used is not state of the art, and in fact probably may have been fooled by the circuit board they etched without going to the additional trouble of making the gel finger. Current technology is collecting more information, and is much harder to fool. Which of course implies that it isn't perfect, but it what is? The real issue for me is "is fingerprint technology increasing or decreasing security?" The narrator made a comment that beating those sensors took them 3 days. In some cases this represents an improvment in security, although not probably for a computer users password (due to brute force password attempts causing lockout..if you have the opportunity to brute force without causing a lock out, then 3 days is probably longer than the password hack would take for most user's passwords.) Think about what the finger print door lock is replacing. One of those mechanical pin locks? Brute forcing a 4 digit pin doesn't take too long, and you can drastically reduce the time required simply by observing someone use the lock and observing a digit or two. You could use a chemical that flouresces under ultraviolet light to see which pins get pressed. For a keyed lock you can just got out and buy a lock picking device. There are certainly cases where even this really bad lock is an improvement. Regarding the phone, even as strictly a convience feature the fingerprint sensor is a nice to have. The Japanese have been using sensors in phones for years, and they love them. You can think of the sensor as a little touch pad for your phone if you don't want to use it for security. You can cursor around menus and play games using the fingerprint sensor as a touch pad. Generally, stay away from sensors that only require you to touch the device and hold your finger there. Touch sensors are either optical sensors which need to have some sort of supporing live tissue sensing technology or a really old non-optical sensor. The new non-optical sensors all look like the ones on this phone. A small sliver of silicon over which you drag your finger.

Re:Better security?

[Anonymous Coward]

Forgot to comment that they only do lock them when a guy with a mask and a chainsaw is running after them. Yep. The car then has 3 locks, voice recognition, and it will only start if both driver and front passenger turn 2 keys 4 ft apart at the same time.

Re:Better security?

[ngc3242]

Doh. Sumbitted parent as HTML not POT. Here's formatting so it's readable.

As someone that works for a major fingerprint sensor manufacturer, I can say that the MythBusters did not select high quality sensors to test against. I'm getting a little tired of people who's entire pool of knowledge about fingerprint sensing is based on this one television making conclusions based on bad information.

I'm not familiar with the door lock sensor specifically, but I can tell from observing it that it is an optical sensor. Whatever live tissue sensing that manufacturer claims to have is obviously not very good because the sensor was defeated with a moist picture of a fingerprint.

The sensor they used on the computer I am familiar with, and it is about three years old. It is, however, based on a much better technology where flesh is live layer of skin is imaged using RF. Unfortunately, the sensor they used is not state of the art, and in fact probably may have been fooled by the circuit board they etched without going to the additional trouble of making the gel finger. Current technology is collecting more information, and is much harder to fool. Which of course implies that it isn't perfect, but it what is?

The real issue for me is "is fingerprint technology increasing or decreasing security?" The narrator made a comment that beating those sensors took them 3 days. In some cases this represents an improvment in security, although not probably for a computer users password (due to brute force password attempts causing lockout..if you have the opportunity to brute force without causing a lock out, then 3 days is probably longer than the password hack would take for most user's passwords.) Think about what the finger print door lock is replacing. One of those mechanical pin locks? Brute forcing a 4 digit pin doesn't take too long, and you can drastically reduce the time required simply by observing someone use the lock and observing a digit or two. You could use a chemical that flouresces under ultraviolet light to see which pins get pressed. For a keyed lock you can just got out and buy a lock picking device. There are certainly cases where even this really bad lock is an improvement.

Regarding the phone, even as strictly a convience feature the fingerprint sensor is a nice to have. The Japanese have been using sensors in phones for years, and they love them. You can think of the sensor as a little touch pad for your phone if you don't want to use it for security. You can cursor around menus and play games using the fingerprint sensor as a touch pad.

Generally, stay away from sensors that only require you to touch the device and hold your finger there. Touch sensors are either optical sensors which need to have some sort of supporing live tissue sensing technology or a really old non-optical sensor. The new non-optical sensors all look like the ones on this phone. A small sliver of silicon over which you drag your finger.

Re:Better security?

[drinkypoo]

Please turn your phone off in meetings or while at dinner - and especially while driving! The former are merely being polite, the latter is not killing a motorcyclist because you were distracted by your phone. Incidentally, the latter - using a handheld phone wile driving, carries a £1000 fine here.

Or you could just use a headset. It's no more distracting than talking to a person in your car, which is still legal. That might even be more distracting because there is a visual component. But the studies say they're about equal.

Anyway you're more likely to kill a bicyclist. Motorcyclists will at least try to get out of your way. It's the bicyclists that like to run down the middle of twisty roads (on which you can't see them until it's too late) at 10 mph.

I believe California starts fining motorists for using their cellphone without a headset next year.

Re:Better security?

[Syberghost]

Yes, I suppose it's possible that if they design this differently than most manufacturers (including Toshiba) do their laptops, and if you configured it specifically to inconvenience yourself, your nightmare scenario could come true.

If, on the other hand, they do what they usually do, and you don't change the defaults, everything you said is alarmist bullcrap.

Toshiba configures their laptops (only thing I can go by, don't have one of these phones) so that you can also unlock them with a password; the fingerprint is just for convenience. I imagine they'll do the same with the phone, because a quick finger swipe is faster than typing in numbers.

As for the horror of discovering your phone is locked and you have to (GASP) SWIPE YOUR FINGER, how exactly is this worse than having to remember and type a code? If you don't like it, don't configure your phone to lock; it's not the default with any phone I've ever owned.

Re:Better security?

[Fred_A]

You're absolutely right, but I would argue that it does not really even increase convenience. The last thing I need when my phone is ringing in a meeting, while driving, or at the dinner table is the horrific realization that I have forgotten to unlock the phone, and thus I must now meticulously subject myself to a fingerprint scan.

You think that's bad ? My phone has a rectum scanner you insensitive clod ! (OTOH I doubt it will get stolen by anyone other than the airport security guy)

Re:Better security?

[CharlieHedlin]

Setting the phone to vibrate usually satisfies most people surrounding and in the case of Dinner a quietly answered and BRIEF call is usually not the end of the world. This allows those of us that are tethered to our jobs (only technical person and the site is expected to be up 24x7) to have some semblance of a life. In movie theaters I can check the caller Id, and if necessary quietly exit and answer the call (usually answering but not saying anything to keep the call from going to voice mail).

There are other people for whom it is far more important to stay connected.

Re:Better security?

[Kichigai Mentat]

Been MythBusted. Adam and Jamie tried a few different methods of breaking the security on a super-high end finger print door lock, including trying to covertly acquire the fingerprint that unlocks it. They managed to fool a high and low end finger print scanner with a warmed ballistics gel finger, and even managed to fool the high end scanner with a photo copy of the finger print, on licked paper, pressed down with a real finger. The high end scanner had the technology you're talking about, yet it was still beaten. Let me know when we get retinal scanners.

Re:Better security?

[Anonymous Coward]

I'm not an expert on the subject, but if the high-end sensor you're talking about was fooled by a photocopy of the fingerprint, then the sensor is optical. Non-optical sensors, like the ones found in the Toshiba phones (and presumably other phones), cannot be fooled by a mere picture of a fingerprint.

Re:Better security?

[Kichigai Mentat]

Well two things. First, that was to illustrate that fingerprint readers are NOT infallible. I'm assuming the non-optical sensor is the kind where you swipe your finger. This is an honest question, now: if it's not optical, how DOES it read the finger prints?

Nice way to get everyone's finger print on record

[Pizaz]

I mean really, what's the guarantee that your fingerprint data wont be uploaded through the network and stored in a big database somewhere?

If it works as badly as Lenovo's...

[istartedi]

If it works as badly as Lenovo's scanner, fuggedaboutit. I didn't really ask for one, but it came with my Lenovo and I thought it would be interesting to try. Sure enough I could not log in without a successful scan, but it usually took 5 or 6 tries. I disabled it after a couple days.

As for losing your hand, well, I would think that most criminals would not risk the much higher penalty for doing that, not to mention the much tougher fight most people would put up. I've also heard scanners have an even harder time working with a dead finger, although I have no idea how they tested that. Anyway, score one for techno-luddites like myself--my cell phone is just a phone. They would get my contact list and a few hours of service until I have the account canceled. Big deal.

Re:If it works as badly as Lenovo's...

[zuiraM]

If someone's actually willing to chop of your finger or hand, are you really going to give them a hassle about it?

I mean, come on, what do you think your subjective evaluation of their willingness to go further would be in that situation?

Especially given how they're not likely to be stupid enough to try something like that without a weapon to threaten you with, or multiple assailants at the same time. Just consider the fact that they're going to have to bring something to actually get it off with. At the very least a knife or a pair of pliers. The former will cut or stab, the latter will stab or bludgeon. And at this point, they thus have a weapon out either way, and you don't: otherwise, they wouldn't be discussing the amputation, now, would they?

Re:If it works as badly as Lenovo's...

[AMindLost]

I've got one of the Lenovo laptops with the fingerprint scanner as well. There does seem to be a knack to it, although I can now always log in with the first or second attempt, usually the first. The knack seems to be to be a quite slow and smooth slide across the scanner. I'm pretty sure Lenovo only put it on their notebooks so that people can gasp at our "secret agent" laptop:)

Re:If it works as badly as Lenovo's...

[Dunbal]

If someone's actually willing to chop of your finger or hand, are you really going to give them a hassle about it?

      You bet.

      What, are you just going to "do what the gun says"? Your best chance is to try to get away. Who says they're not going to kill you, if they're willing to cut your finger off. Why leave a witness alive?

Re:If it works as badly as Lenovo's...

[sporkme]

I would just put said finger in the jamb of a door and kick it shut. Just saying. I mean, the data are so valuable that they went to the expense of biometrics! zomg

Re:If it works as badly as Lenovo's...

[butlerdi]

Much easier on a laptop. We beta tested handhelds with fingerprint scanners and it is really difficult to get a good read while trying to position the device and finger properly. Also when phone is ringing you are generally trying to access the call as quickly as possible. Even the Compaq PDA's were a pain, on smaller devices this is just frustrating..

Re:If it works as badly as Lenovo's...

[maxume]

Who says they are going to ask? I figure someone willing to cut off you finger is quite willing to kill you first, without bothering to ask how you feel about it.

Re:If it works as badly as Lenovo's...

[FSWKU]

If it works as badly as Lenovo's scanner, fuggedaboutit. I didn't really ask for one, but it came with my Lenovo and I thought it would be interesting to try. Sure enough I could not log in without a successful scan, but it usually took 5 or 6 tries. I disabled it after a couple days.

Are you sure you set it up correctly? I'm writing this on a Thinkpad T60, and have absolutely no issues whatsoever with the fingerprint scanner. If it takes me more than one or two tries (which happens VERY rarely), then I resort to using a password to login.

And what's with everyone screaming "they'll chop off your finger/hand/whatever to get your data" when talking about biometrics? Honestly, what is the probability of that happening over, say lifting your prints off of the device itself, making grave threats, or simply hacking into the device (if someone has physical access, time, and motivation, a password/fingerprint/iris isn't going to stop them...especially if you don't use encryption). Chopping limbs is a messy business, and most thieves really don't want to go to all of that trouble. Fingerprint readers are great for keeping co-workers, siblings, classmates, etc. from snooping around your data, but if someone actually steals your device for the data on it, they're more than likely going to get it eventually. However, most thieves don't care a whit about what's on the device. They care about how much they can get for it. If they're slightly tech-savvy, they're more likely to wipe the device clean and do what they want with it after that.

Re:If it works as badly as Lenovo's...

[zuiraM]

There is a mental step between chopping someone's hand or finger off and killing them that should not be underestimated, although I agree that it may be more likely that they'll kill you first.

Of course, if they start out by trying to kill you, the reasonable response is to stop them from doing so. Permanently, and by any means available.

Re:If it works as badly as Lenovo's...

[zuiraM]

Not all places have as bad statistics in this regard as the one where you live :)

My reasoning is, if they're going to kill you, it'll be a lot less hassle for them to kill you first and then remove your finger afterwards. Especially considering they may have the element of surprise before you know their intent, which they will lose once they've asked for the finger or hand.

If they try to kill you up front, you try to get away / defend yourself, as appropriate to the situation. Same thing if they try afterwards; the amputation may even make this easier (if your survival instinct kicks in), as losing a finger will prompt an endorphin-adrenalin rush and losing a hand gives you two very sharp exposed bones that will easily penetrate the human body (at the cost of additional damage to the stump). Plus, more importantly, you're a lot less likely to hold back, consciously or subconsciously.

If they don't try to kill you at first, give them what they want, but keep an eye open in case they change their mind about killing you. Of course, if you *have* an opening to shut them down without aggravating the risk to yourself, by all means do so.

As a general rule, the assailant who is willing to do this will have more experience in combat than the average Joe/Jane, making it (IMHO) poor advice for the general, untrained population to engage them in combat before/unless there is an apparent, high risk of a lethal outcome even when complying. This is one of the reasons I try to keep my self-defence skills up-to-date: to improve the odds of survival if things should go badly in an encounter.

Re:If it works as badly as Lenovo's...

[zuiraM]

Hehe. If you're going to do that, you might as well go for intimidation :)

Slice your wrists and give them the old "are you ready to die, punk" routine, or something ;)

gummy bears

[MillionthMonkey]

That stuff they make gummy bears out of is great for making fake fingerprints using someone's latent print, some crazy glue, a digital camera, Photoshop, a transparency sheet, a photo-sensitive PCB, and gummy bear gelatin. You can destroy everything but the gelatin, break into a facility that uses a fingerprint reader for security, and then eat the last bit of evidence.

Re:gummy bears

[o'reor]

> and then eat the last bit of evidence.

That's the best part of it :-)

Re:gummy bears

[alx5000]

- And you must be the man who didn't know if he had a pimple or a boil...
- It was a fingerprint-reader cracking device...

Re:gummy bears

[Anonymous Coward]

Cool! I'm going to use this to break into a gummy bear factory and steal more hacking tools. Mmmm, delicious irony.

Already Existing Technology?

[Poptarts]

If I'm not mistaken, this technology has already been implemented in some Japanese phones. I recall seeing it advertised on the http://www.nttdocomo.com/ website more than a year ago. Other features at the time included what equates to our PayPass, except that it was inside your cell phone. Another more widely used feature was the barcode scanners that would allow you to take a picture with your phone's camera of a square-shaped barcode that could be found on many advertisements and products and then find more information using the phone's web browser. Perhaps I misread the website a long time ago, but I'm pretty sure some other phone has already been released with that capability.

But I Have

[phalse phace]

No fingers, you insensitive clod!

Re:But I Have

[Zapotek]

No fingers, you insensitive clod! If I give you my fingers, will you give me your phone?

Re:But I Have

[Shadyman]

Well, it sounds like you need a hand.

Re:But I Have

[Anonymous Coward]

If you have no digits, what use do you have for a phone?

Re:But I Have

[Anonymous Coward]

How did you write that, then?

Re:But I Have

[Suzuran]

How does you types with boxing gloves on?

Backdoor?

[VincenzoRomano]

Almost all phones have backdoors that can be used easily without opening the phone itself.
All of them can be "cracked" by opening the case.
Both are available for repair centers (and hackers as well).
So if someone really needs your data, he will get them, with or without your chopped finger!

Re:Backdoor?

[jrumney]

Some phones are starting to encrypt their storage, so breaking into them through the servicing routes is not going to get you much information. Windows Mobile 6 will encrypt any external storage card if configured to, for example.

Re:Backdoor?

[VincenzoRomano]

Data encryption on a cellphone cannot be too powerful as the computing resources are quite scarce while access speed is important.
Moreover some algorythms have been proven to be breakable.
I still think finger prints on cell phones is just marketing buzz.

Re:Backdoor?

[Valdez]

Sure... but it would have kept my clincally-jealous-but-not-technically-savvy ex from digging through my call list every time I turned my back.

Joe Hacker does not describe 95% of the population.

Re:Backdoor?

[jrumney]

Symmetric encryption algorithms are not very computing intensive, cell phones today have plenty of CPU power compared to the PCs of 15 years ago that used to run the same algorithms acceptably.

Moreover some algorythms have been proven to be breakable.

Anyone who uses SHA-1 or MD5 for encryption is going to be waiting a looooong time to decrypt their data, even on the fastest processors. Best steer clear of them for encryption, regardless of how "breakable" they are.

Re:Backdoor?

[VincenzoRomano]

Keep your cell in a safer place!
And your ex as well.

Re:Backdoor?

[Valdez]

pshaw! My phone's desire to land on the living room coffee table when I get home won that fight.

Re:Nice way to get everyone's finger print on reco

[Sinryc]

Time to put on the tinfoil hats! No, its the fact that in order to do something like your thinking, you need all the proper permission... unless you already think that "The Man" will do what it wants, no matter what.

I'll buy one

[stupendou]

I think Toshiba is breaking new ground with this phone and its release is likely to start a trend. The need for security is actually higher for a mobile handset than for a laptop, as they get lost far more often.

And despite the various comments about cutting off fingers and lifting fingerprints, have we seen much of that in the laptop world? No. Will it happen one day? Maybe.

I've seen this phone at 3GSM, and the other point that is missing is that the fingerprint reader can also be used as a navigation device, both for menus on the phone itself as well as for a PC in close proximity. At 3GSM they are showing the phone controlling a powerpoint presentation on a laptop.

Very cool!

Re:I'll buy one

[DrSkwid]

> The need for security is actually higher for a mobile handset than for a laptop, as they get lost far more often.

So why carry unencrypted sensitive data on them ?

Re:I'll buy one

[stupendou]

Why indeed? Encrypt it if you're worried, or for most people, just let the fingerprint unlock the phone so even unencrypted data is somewhat protected.

Re:I'll buy one

[ChameleonDave]

There are 11 types of people in the world, those who know binaries and those who don't. Surely there are two (10) types of people, not three (11).

Give him a hand?

[MarkRose]

If someone wants to chop my hand off to use my cell, well, I'll just give him the finger!

Nothing new!

[KNicolson]

My wife's phone from three years ago had one. It also incorporated a dog game/simulator, and one of the ways to make the dog happy was to get your fingerprint swiped in order to pet the dog.

Now, what is new and interesting is the 813SH for Biz which has a remote control data destruct option, or even the slightly older P903i which comes with a wireless DES dongle that locks the phone once it gets out of range.

Re:Nothing new!

[ajlitt]

Sounds like BluePill for PalmOS Treos. This is an app that can lock or format all internal and external storage when it receives an SMS containing a command keyword that you specify. It can even respond via SMS that the operation is complete or to a "ping" command to determine if the device is still alive and connected. If only Palm made AGPS available in these phones...

Old news

[Anonymous Coward]

How is this new? My (Japanese) Docomo phone from 2005 has a fingerprint reader. I use it frequently.

Re:Old news

[stupendou]

The difference is that one didn't work very well, drained battery power if used often, and probably didn't have navigation capability.

Re:Old news

[Anonymous Coward]

thanks, that was very boollshit of you.

Re:Old news

[Anonymous Coward]

You obviously have no idea what you're talking about.

What happens if the scanner breaks?

[antifoidulus]

I asked this at a research conference once(it was about mobile phone security as well) and the researcher, who had drawn out all these equations showing how wonderful the fingerprint security was couldn't answer me. For a device like a mobile phone that tends to get tossed around and abused a lot, I wouldn't imagine that the scanner breaking would be all that rare of an occurence. However, the researcher just said that if the fingerprint scanning device was broken, then you could use a password instead, of course this was after he spent the first 5 minutes of his presentation telling us how passwords were insecure. Assuming that passwords are insecure, wouldn't the first thing an attacker does when getting the phone be to smash the fingerprint scanner? Then what was the point?

Re:What happens if the scanner breaks?

[eddy]

I'm no big fan of biometrics, but I believe the idea is that you can have a way longer password than you'd usually have, probably written down somewhere at home instead of memorized, because you'd only use it on "rare occasions" where the convinent biometrics break down.

Again, I don't buy into biometrics, especially not as a single-point of "security", but that's how I'd expect a vendor to defend himself against your argument.

Re:What happens if the scanner breaks?

[justinlee37]

"probably written down somewhere at home instead of memorized"

Looks like your biometrics just made your password less secure. Zounds!

Re:What happens if the scanner breaks?

[eddy]

If the person stealing the phone is in my house and able to go through my paperwork in search of a password, I believe I have bigger problems to worry about than losing a few dollars in non-authorized phone calls.

Personally, I have almost all my passwords written down in PasswordSafe. That's the best option I've found, given that I can't memorize 200 good passwords.

Re:Nice way to get everyone's finger print on reco

[Niten]

Frighteningly, I don't think there's that great a difference, in terms of technical feasibility, cost of implementation, or legal dubiousness, between the NSA clandestinely spying on the private conversations of U.S. citizens by the aid of AT&T and others; and that same agency, hypothetically, collecting fingerprint data from consumers by the aid of whichever cellular carriers will offer this phone.

It may seem improbable, but we've already seen equally grievous government intrusions into personal privacy. Such a scenario would honestly just be more of the same at this point.

This could be good in some situations...

[therufus]

Like if you have kids that use your phone all the time. Or if you leave your phone in the office and don't want people using it to make calls when you're out. Or even the sheer fact that it will act as a deterrent for your average thief.

Not everyone has military grade secrets on their phone, but a vast majority of people who will steal mobile phones won't be interested in the numbers/sms/etc on the phone anyway.

Granted, if people want your info, they will get it.

Re:This could be good in some situations...

[Tanuki64]

Or if you leave your phone in the office and don't want people using it to make calls when you're out.

People like that deserve whatever is done with their phone. Preferably long and very expensive phone calls. Constantly ringing cell phones are always an annoyance, but leaving it lying around in an office without being able to take calls as fast as possible, so that colleagues are bothered by the ringing, should be considered harassment at work.

Re:This could be good in some situations...

[therufus]

Maybe where you work. Where I work we all put our personal phones on silent when we're at work. So an annoyance they are not. Fingerprint ID would be handy though.

fingerprint recognition

[Elusive_Cure]

as i have previously mentioned in an older post, i used to participate in a reasearch at my uni for a major mobile phone company (sony ericsson) for the implementation of fingerprint recognition on cell phones and other mobile devices (PDAs,notebooks,etc). Personally i preffer the fingerprint sollution rather than the RFID one because the phone's security is up to you and not as "hollow" as RFID can be by the use of reverse engineering. It's simple, if your phone is stolen the perp needs to have your thumb or else the phone is just another piece of garbage. You cannot reverse engineer a fingerprint simply because you cannot have a clue on how the actual fingerpint is shaped, while the scanning software is something very ubiquitous and tough to be "hacked" by someone who hasn't got a clue of the scanning algorithms.

Re:fingerprint recognition

[strider44]

Not sure about that. It's been repeatedly shown that fingerprint readers aren't secure and can be broken trivially. Not only this but they are unreliable with plenty of false-negatives. The biggest practical problem though is that you're moving the danger from something mostly harmless to lose (your phone) to something stupidly horrific to lose (your finger or even your hand). You need to think of what you're protecting here - I'd rather have the phone in danger than a finger.

Biometrics have never been really that practical.

Re:fingerprint recognition

[RMH101]

"You cannot reverse engineer a fingerprint simply because you cannot have a clue on how the actual fingerpint is shaped" - unless of course you have a handy source of copies of the owner's fingerprints ALL OVER THE PHONE CASING ALREADY!

Severed digits

[jimbob666]

Of course it also means that someone is more likely to chop your hand off if they desperately want your data.

Only if the scanner can read cold severed digits! :)

Re:Severed digits

[Tony Hoyle]

Warm the finger up by, say, holding it in your hand for a while.

I very much doubt a scanner can tell the difference between a warmed up finger and a living one.

Heck, they can't tell the difference between a finger and a gummy bear at the moment...

Re:Severed digits

[Anonymous Coward]

Of course it also means that someone is more likely to chop your hand off if they desperately want your data.

Only if the scanner can read cold severed digits! :)

And when the guy with the big knife finds out that it can't, do you think he is going to give you back your hand?

What happens if you lose fingers and hands?

[antdude]

Hey, it can happen. :)

Re:What happens if you lose fingers and hands?

[youthoftoday]

You wouldn't be able to complain, so your view wouldn't be heard and you couldn't prove that you exist. The antecedent to this surely must be that fingerless handless people *do not exist*.

Re:What happens if you lose fingers and hands?

[laejoh]

Without hands you wouldn't be able to hold your phone, so forget about scanning your finger, duh!

This would be the LAST feature they would cripple

[gd23ka]

You should know by now they only cripple useful features people want.
They could put biometrics on phones and then use that to connect the
phone even tighter to you, the actual person. With biometrics on board
the defense you loaned the phone to a third party is gone.

Also you could be called by some agency and ordered to present your
fingerprint at random intervals maybe as part of some probation
monitoring scheme.

Oh dear, where do I begin..

[cheros]

Groan. Here we go again..

I think Toshiba is breaking new ground with this phone and its release is likely to start a trend.

I most certainly hope not, for reasons stated below.

The need for security is actually higher for a mobile handset than for a laptop, as they get lost far more often.

The need for protecting an asset has little to do with the frequency or potential for loss, more with the information that would be lost or compromised (different facets with different ratings) and that is a very personal assessment. The Paris Hilton hack was very dangerous because her Sidekick contained personal numbers for people that have to fight hard as it is to have some sort of private life and security, but a Mr Average phone is not going to hold data of sufficient value to offer up irreplacable body parts for. You can replace a phone, you can replace numbers but you can't replace a cut off finger (given the likely conditions under which the amputation would occur you can give up any hope on re-attachment as well).

And despite the various comments about cutting off fingers and lifting fingerprints, have we seen much of that in the laptop world? No. Will it happen one day? Maybe.

In laptop world the fingerprint scanner is (a) a relative new device and (b) not working so well, so thankfully most people don't use it. Also, most laptops are removed without the users' knowledge because it's often important to have some time before the theft is discovered (in case of targeted theft) and (using Windows) breaking into the unencrypted device is just a matter of booting up from a CD.

Now imagine a world where biometrics are the ONLY way to gain access - at that point you will lose the option to give in under threat and provide a password - your finger WILL be used, with or without you inconveniently attached to it. It can get even worse: with passwords it requires on your collaboration so there's an interest in keeping you alive. With biometrics-only devices an assailant has the wonderful option of killing you first, then using your chopped off digit in the comfort of his own place with a nice cold beer. That's quite a handy option for them because it stops you from becoming a risk later.

So, with implementing biometrics I would ask the Clint Eastwood question: "Do you feel lucky?".

Slashdot Fool? LOL

[Anonymous Coward]

>>There's no way I'm buying a phone with an operating system that crashes 10 times a day and needs 900-1200 times more CPU and RAM than Symbian.

So you should be fine with this phone then, because the above is 100% weapons grade bullshit.

So why isn't this phone using Symbian if it's so f'in wonderful? Oh yeah, it's not up to the job and horribly underfeatured. lol

It's all about choice

[squoozer]

May I be about the only person here to say that this sounds like a good idea. Fair enough it's not secure enough to protect your uber secret data but realistically how many of use are carrying information that is that vital in our mobile phone? What most of use want the password for is to make our phone virtually worthless if stolen. If you are carrying around data that is very important then I would suggest so other form of encryption.

Re:by opening your mind

[stupendou]

Millions of laptops are sold with fingerprint scanners nowadays.
How many people do you know who have had their fingers cut off to access data?
How many people have had their eyeballs popped out to fool retinal and iris scanners?

Most thieves look for convenient opportunities rather than bloody, messy, longer jail-sentence crimes.

And if you insist on fast-forwarding to a future where biometrics are the ONLY way to gain access, why do you assume no one in the future will solve the problem of cut-off fingers fooling a scanner? C'mon!

What if ...

[toygar.ozturk]

my hands are dirty?

It's also a scroll bar

[giafly]

... the fingerprint scanner also doubles up as a touch-sensitive scroll interface that lets you scroll down emails, menus or Web sites simply by sliding your finger over it. While it may seem strange to have the scanner on the back, it's actually quite well placed because your fingers are on the back of the phone when you're holding it.

This sounds a more sensible use and kudos if they didn't patent it.

The Man

[Dystopian Rebel]

unless you already think that "The Man" will do what it wants, no matter what

Fortunately for democracy in the USA, The Man is strictly limited in what He can do by the Patriot Act.

Re:The Man

[geminidomino]

Ouch... that must have hurt, your tongue blasting through your cheek like Kool-Aid Man and all...

Tiny flaw

[kahei]

I don't know that people would need to chop your hand off to get your data. I mean, all they'd need would be your fingerprint. But where would they find that? Oh, wait, they already have your LOVELY SHINY PLASTIC PHONE THAT YOU TOUCH WITH YOUR FINGERS AND THAT HAS FINGERPRINTS ALL OVER IT.

So I'm a little skeptical. Another thing that makes me skeptical is that I've worked with lots of devices that require fingerprint scans, and honestly for the tiny amount of security they add the inconvenience is so huge that they're usually the first thing to go if anyone gets the chance to make changes. They can be effective for licensing (making sure the person to whom information is licensed has to actually be there when it is read) but how many other types of security issue depend on a bad guy having physical access to the machine -- yet not being able to [tamper with / fool / reboot and remove the driver for] the fingerprint scanner?

FUD FUD FUD

[youthoftoday]

They'd only want your finger.

Re:FUD FUD FUD

[Overzeetop]

Yeah, but which finger? Best to take them all - you wouldn't want to get stuck with a phone and the wrong finger. Though, I suppose you could always make a cup of chili with it, so it wouldn't be a total loss.

finger or pine code

[deadlocked]

I'd rather have my finger chopped off than terrorized for my pin code!

Actually, if your phone or the content in the phone is that valuable, then you deserve your finger chopped off

you always have your password

[Shivetya]

I have one of these scanners on my laptop. Its great. I have a nice complex password for access that I can skip simply by scanning a finger. I like the convienence. Do I think its anymore secure? Not in the least.

Its better for me that using a usb key or such, I am not going to lose my finger

Re:you always have your password

[digitig]

There is one sense in which it is more secure. I don't have to worry about anybody looking over my shoulder to see my password if I'm scanning my finger.

It's not a Lawgiver!

[DrSkwid]

I still don't understand why you think my phone needs more security than my laptop per se. If I think I'm going to lose something often then I should assume I am going to lose it at any moment ergo I should make sure it's notionally disposable. Even my ancient Pentium III T23 laptop would cost me more to replace than my brand new Nokia so why does it need a biometric. It's not a Lawgiver!

Re: It's not a Lawgiver!

[stupendou]

I was speaking in generalities, not your specific case. Obviously, the need for security is related to the pain in losing the device, and I agree that pain has to do with the sensitivity of the data you choose to store on it.

Given that both these models are business phones, users are likely to have sensitive emails and passwords stored on them. If you assume those passwords allow access to corporate databases and other secrets, one can make an argument for these devices containing information that is as valuable as that stored on a laptop.

Therefore, since the devices are easier to lose, the need to protect them is greater.

Re:by opening your mind

[Anonymous Coward]

why do you assume no one in the future will solve the problem of cut-off fingers fooling a scanner?

Um, because it's already been solved. Fingerprint readers on computers and door locks have proven trivial -read that word again: trivial- to crack, usually with minor effort easily within the reach of the most common criminal. All it takes is access to a xerox copier or some candy. Look up the Mythbusters episode referenced in some other posts. The professionals are even better at it.

In NO shape or form should a fingerprint reader be considered an effective security tool. It's absolutely worthless, a statement I don't make lightly. The only thing worse than having NO security is having something you THINK is secure and relying upon it, when it's actually totally insecure.

Biometrics have a long way to go to fulfill the promises that have been made about them. So far, it's mostly hype and bull and huge powerpoint presentations about how it's unbreakable and will change the world. Meanwhile unskilled people on a TV show bust it wide open in under two minutes, on their first try, without any particular skill in B&E or security. With cameras rolling.

If this embarrassment by TV amateurs is annoying, imagine what the professionals crooks can do with these locks.

Go find that video. Watch it.

Sobered up yet? If you're not swallowing hard and turning several shades paler, you're in the wrong business.

The moral is simple: to get past security, you only need to attack the weakest point in the fence. Nobody can devise a system without weak points.

yeah

[DrSkwid]

*surely* there's only *one* binary

congratulations, you're number 3 (0100) not 2 (0011) or 1 (0001)

to feel the need to correct me

Re:yeah

[Anonymous Coward]

Oh dear, it appears I have blundered into a ./ wanker. I was casually and civilly commenting on your sig, and you feel the need for a snide response (quoting back "surely" with extra emphasis, mentioning the "need to correct" you when I could just as easily mention your "need" to put pretentious code in your sig, doling out sarcastic "congratulations"...)

No doubt you are making some pizza-eating, no-girlfriend-having, Linux-hacking, nerdy, esoteric reference to some special binary code unavailable to ordinary mortals, but here in the relatively real world the number one is written 1 in binary, two is written 10, three is written 11, four is written 100, five is written 101, etc. Therefore, my comment was quite reasonable and your sig was non-standard. There are people who know this, and people who don't; that makes two (10) categories of people.

Hmm

[Fist! Of! Death!]

If this type of technology on mobile devices becomes widespread you can bet that it will eventually be used to boost fingerprint databases for law enforcement. To be honest I cannot decide whether that is a good or a bad thing - intelligent criminals (the type who maniacally stroke fluffy white cats) would probably easily find a way to fake their record, but finding a hit on a fingerprint would at least narrow a search for the police.
CSI directors I am sure will have this in a script in the near future...

Re:Hmm

[Anonymous Coward]

The fingerprint scanner only stores a hash of certain parts your fingerprint and not an image of your entire fingerprint. This makes not possible for using it for law enforcement.

Somewhat relatedly...

[KKlaus]

Interestingly enough, in nearly all states the penalties for kidnapping equal or exceed the penalties for murder (particularly if it's not first degree). So the same goes for if someone is trying to kidnap you... there's no compelling for them to leave you alive, and in fact there are a lot of compelling reasons for them not to, so you should do your best to escape. Not that that will probably ever be useful information for any of us, but it is somewhat interesting (at least imo).

Cheers.

Re:Somewhat relatedly...

[zuiraM]

Kidnapping, sure thing.

It is, in every way, in your best interests to stop them, og go down trying to do so.

Ok what if I'm wearing gloves.....

[Anonymous Coward]

..or worse yet my fingers are injured enough that the scanner won't recongnise
my thumbprint? Then what?

Or if you are really brave ...

[snoggeramus]

You could always just give them the finger. Oh, nevermind ...

because you can't avoid it

[RMH101]

...on a work mobile, the contacts in your phone book may be, and probably are, sensitive. Have a look at your own - have you got direct dial numbers, names, departments etc that could be used by a social engineer?

Re:This would be the LAST feature they would cripp

[Rakishi]

Yeah and they'd argue that it is impossible for someone to have used your phone, despite it being quite possible to copy a fingerprint. I believe insurance companies did that regarding some "unbreakable" security systems/locks in cars (ie: we're not paying because despite you claiming your car was stolen we claim such an act is impossible so go stfu).

They can have my finger...

[phozz bare]

...when they pry it from my cold, dead hand.

Oh wait.

Ob Spaceballs Ref.

[tomhudson]

"How is it any worse than entering a PIN?"

It isn't - because nobody locks their phones ... and the nobodies who do, its almost always 5-5-5-5-5, because that's easy to key in without really looking (like when driving). It's the cell phone equivalent of 1-2-3-4-5.

Re:Ob Spaceballs Ref.

[mikecardii]

I lock my phone just for the hell of it because I don't like people snooping around in my shit. I have a T-mobile MDA, btw. The code I use is 1-3-3-7. =D *waits for someone to h4x my phone*

Your rhetoric is most amusing, this pleases me

[DrSkwid]

So then, you thought you were a clever chops and it turns out you're just a wannabe an donce discovered you turn to insult based on your incorrect stereotypes.

The clue is in the "know binaries" not "know binary".

Christ, even java programmers encounter BCD occasionally, though this isn't that scheme.

You lose, twice!

n00b

[DrSkwid]

dave, lol, welcome to texas

F@($ing cold

[thorkyl]

So now I have to remove my glove in sub zero temps to answer my phone.

I guess I will not buy one, I will stick with my samsung thank you...

does anyone lock their phone with a pin?

[JimBobJoe]

I really haven't met anyone who locks their phone, regularly, with a PIN anyway. It's a lot of hassle for what is often data that is more important to have a backup copy of than to secure from other people.

So it seems to me that this is even more overkill.

I did have a phone once, a Sanyo (SCP-6400 I think) that allowed you, if you setup the feature, to send a specially encoded text message with a password, to the phone, which would erase the phones data. I thought that was a nifty feature if the phone were lost.

To be fair however, I never setup the feature.

Great

[dlhm]

So now when my phone gets hacked, they will have my fingerprints too.. Thats Just what I need .. Oh the crimes they could stage with all the free fingerprint.

More security leads to stronger attack modes

[Swave An deBwoner]

Of course it also means that someone is more likely to chop your hand off if they desperately want your data.

And it means no more dialing with your nose after you manage to wiggle your cell phone out of your pocket with your hands tied behind your back in the trunk of some kidnapper's car. Oh well, at least the kidnapper will have to ask your permission to make the ransom call before chopping your head off.

Moo

[Chacham]

Of course, McGyver could then use anyone's phone.

Yep, my phone has had this for years

[MochaMan]

I bought an F901iC in 2004 with a fingerprint scanner built in. Works surprisingly well.

Re:Yep, my phone has had this for years

[Anonymous Coward]

Fujitsu has featured fingerprint readers on cell phones since at least 2003 (F505i).

Why this is potentially *great*:

[screaser]

I think lots of people are missing the real potential here; think about the possibility of pointing your cellphone at a vending machine or point of sale console and making a purchase instantly. Very very handy.

Now imagine your phone being able to make purchases directly without something like a biometric finger scan -- very scary.

This isn't just to protect the data in your address book -- get over yourself, you don't have that many secret numbers... this is to allow the phone to evolve towards an all-in-one device that lets you leave your wallet behind.


And can we stop the ranting that everyone will start cutting fingers off right and left.

• Steal phone: 3 months probation. Cut off finger: 10+ years. They're not that desperate for your data.
• Can you really imagine others *not* noticing when you pull out a severed finger to make your purchase?

Re:by opening your mind

[stupendou]

So much of what you say is so easily refuted it's not worth the effort. No wonder you posted as an AC.

Not better security, but deterrent

[recharged95]

It would be neat one day to have a fingerprint login to your phone and GPS capability. Then if you lose your phone, no one will really bother with it (i.e. hopefully not throw it in the trash) and you can call it, get the location (mapquest) and recover the phone (with all it's valuable info).

Restricting *your* right?

[Valdrax]

The problem isn't really the cell phone, the problem is the inability of the majority of the population to focus on more than one task at once.

If by the majority of the population you mean "human beings," I would agree with you. It's a fundamental problem in the hardware of the brain. Basically, paying attention while driving uses the same "channel" in the brain that responding in conversation uses. We "speak" to ourselves when navigating. There's a fundamental bandwidth limitation.

Read more on dual-task separation research at the University of Utah's psychology department.

Invariably, some politician will 'correct' the problem by restricting *my* right to use a phone.

The problem is that a lot of people are fundamentally unaware of how much talking while driving detracts from their ability to drive. Studies show that you're just as dangerous as "those other drivers." You just might not be aware of it.

(Well, I suppose there is a difference between people who are *trying* to pay attention to the road and blathering idiots, but you're still not as safe as someone who isn't talking.)

Observations and other uses.

[COMICAGOGO]

First off, I have a toshiba laptop with the built in scanner. It works most of the time (often enough that I still use it to log in when I'm inpublic and don't want people looking over my shoulder while I log in.)
            Second I think that the idea of getting someones fingerprints from the phone and using them to unlock it is a little misplaced this time. Most of the posts that I have seen here suggest that you could make a fake finger print from some sort of gelatin. This works with the kind of fingerprint scanner that reads the whole print at the same time. The one in my laptop requires you to drag your finger over a very slim portion of the reader (I assume that it reads your fingerprint one line at a time.) I do not think gelatin would hold up to this kind of activity.
            As to the breakability of the scanner: I have dropped several heavy things on mine (yes my laptop is a poor miserable wretch) and it still works fine. I think this is also due to the small size of the scanner. It would take a very hard and directed hit to break the thing. The scanner itself if down in a hole and is only about one eigth by three quarters of an inch.
            Some other uses that might make this more palatable for people: if the software works the same way as my laptop you could have each finger represent a different speed dial number (the software for my lappy actually remembrs 20 fingerprints.) I could see this being very useful as you wouldn't even have to open the phone (clamshell) or get it near your head to start dialing. just run your finger and it starts dialing up gramma's house.
            You could also assign different user levels with it. For example you have limited calling features for your teenager when they swipe a finger but you have full access.
            This one isn't for everyone but you could take theabove use a step further and track calls by each user.

            AnyWho just thought I would suggest some uses tht might not make this thing all bad.

Re:This would be the LAST feature they would cripp

[gd23ka]

Normal mobile phones are "secure" when you have locked them
to the inserted sim (i.e. locked it to country/network _and_
sim serial number) and activated mandatory pin entry. Then
the phone will refuse any other sim but the one present when
that simlock was set and force you to present PIN1 to that
sim. But let's not kid ourselves, there is not a phone out
there that doesn't have details and even original internal
service and diagnostic software leaked... ...and so resetting these stolen fingerprint phone to pristine
out-of-the-box factory conditions should be no problem after a
while once command sequences, secret keys and software are leaked.
Which is too bad, because a phone really should turn into a brick
once it is taken from its owner and not at all be capable of
carrying out factory commands once it has been personalized
and put into service... but I disgress...

the fingerprint reader is not about making authenticating yourself
to the phone more convenient, or making the authentication process
more secure.. it's about getting people used to presenting their thumbs
to readers. I know that to some this might sound moronic at first but if you
think about it I believe you can see the point I am making here.

Well, it's the century of cowardice after all.

[Medievalist]

If someone's actually willing to chop of your finger or hand, are you really going to give them a hassle about it?

Since the 21st century seems to be populated mostly by terrorized weaklings, I doubt an attacker would have to go that far.

"Give me your fingerprints, or I'll hold my breath till I turn blue!" would probably be sufficient... if not, one could always threaten to say some really bad words.

Chopped off hand

[adrianbaugh]

Of course it also means that someone is more likely to chop your hand off if they desperately want your data

Has this ever happened? People always bring it out as an argument against fingerprint scanners (or other biometrics) but I've never seen a news report of anyone having their bits chopped off to access their data. And you'd think if it happened it would definitely make the headlines just for the yuck factor.

Good but....

[Anonymous Coward]

I think this is good feature but like many of these low cost biometric devices it has some limitations like if you have a cut on your finger then it would deny you access... especially when when you really need like when you are injured.
I seen and have used several of these biometric ID devices and some are surprisingly good of identifying you properly even though the device is dirty, the finger has some damage (cut, etc), use of alternate finger (if your ID finger is covered with bandages). There were a few I had to have absolutely clean finger to get a good ID.
I think a biometric ID phone would be great for those in high security group that have good reason worry about wrong person calling someone important. Again like some movies someone really desperate would cut your finger to get access to the phone.

Re: it's not as closed as you think :-)

[cheros]

At the moment there are still alternative methods of access so the forcible removal of body parts is not happening yet (except for people carrying a donor codicil, but that's organ /trade/ and another story altogether). Under threat you can choose to give access.

There are already scanners that check for things like body heat and (IMHO a more clever idea) a pulse in roughly the same way as a hospital finger pulse reader does it, but the pulse one has the problem that it's possible to pick up latent prints from the way it works (it's not a 'swipe' style scanner). But that too will be bypassed - it's the usual arms race.

You would be right with your millions vs. a few incidents (incidentally, also the same argument to put a terror threat into a reasonable perspective) if you consider that not everyone has data worth stealing except for your very identity. So you could say that the height of your presence on the food chain ought to directly correlate with an increased aversion to biometrics..

BTW, as a slight aside, the popping eyeball idea for bypassing biometrics was used in the "Angels and Demons" book by Dan Brown (better known for "The Davinci Code" :-). CERN has shown a sense of humo(u)r and put up a page matching the book against reality.