Fingerprint Recognition with Linux & IBM's T42

Michael R. Crusoe writes "UPEK, provider of popular fingerprint sensors to IBM's T42 notebooks and others, has announced that they will be providing a BioAPI compliant library to perform biometric authentication under GNU/Linux. Will Linux be the first operating system to have integrated biometric user authentication 'out of the box'?"

By the way, biometrics & DRM ?

[Arthur B.]

Put now your finger on the scanner to play this drm-protected wma. Well... kinda better than hardware fingerprinting anyway. But way more spooky.

Re:Ahem, PAM

[/ASCII]

The reason why making a general purpose API is better than hardcoding for a single use authentication algorithm is that you get:

• Less lock in, since when the next generation of PAM killer comes along, the switch will be much easier.
  
• Better portability to systems that don't use PAM. QNx, ReactOS, Windows, MacOS the world is a big place...
  
• More uses for the software. Maybe you can use this fingerprinter together with a Firefox plugin to slightly increse the security of your bank transactions?
  

If the above reasons are enough to warrant the extra layer of indirection, I do not know. But saying that there are _no_ advantages to making a general purpose API is plainly false. It's a simple tradeoff.

Finally...

[Anonymous Coward]

now I can REALLY finger my computer!

Re:Ahem, PAM

[nokilli]

Well, you know, you can even have plaintext passwords stored in world-readable text files you keep in /hack/me/now but why would you use PAM for this?

The whole point I thought was to create a framework through which it would be impossible to recreate the user's authentication info.

We do what you're saying and the next thing you know, I have your fingerprint, or even better, I've replaced your fingerprint with mine.

Finally...

[Ranma-sensei]

I think it's great - and time! I really don't like having to remember 20 or so passwords just so because if one of them gets hacked my other data is secure. :(

Re:By the way, biometrics & DRM ?

[dancallaghan]

Mod parent insightful! DRMing content according to the buyer's fingerprint pattern is an excellent way to make sure they are the only person using the content. Oh and as a side effect, M$ and [insert other evil DRM proponents here] would get to see your fingerprint ...

Spooky indeed.

*Bah*, fingerprint scanning is yesterdays news...

[de Bois-Guilbert]

...what I want is retinal scanning!

I'd imagine the patterns in our eyes are more difficult to duplicate for nefarious purposes than our fingerprints, which (besides the cool factor) would mean increased security... On the other hand, I'd rather have the arch-villain chop off my finger than carve out my eyeball.

Re:Finally...

[dancallaghan]

Except you couldn't switch to using only biometric authentication (not until they get a little DNA blood pinprick scanner thingy, anyway), so the best place for biometric authentication is as an added layer of protection on top of the 20 regularly-rotated random passwords stored in your brain.

Yes, my tin foil hat fits very nicely thankyouverymuch.

Wouldn't a password be better?

[EMIce]

At least you can change them.

http://www.theregister.co.uk/2002/05/16/gummi_bear s_defeat_fingerprint_sensors/ [theregister.co.uk]

Re:Here's a guy that won't be using it!

[t_allardyce]

Unfortunately most people don't think about the consequences of anything. If fingerprint recognition grows as a technology its likely we're going to see more of this, which is why I believe its a basic human right not to be forced to use fingerprints to identify yourself. Fingerprints belong in crime investigation only.

How it works on Windows XP

[brunogirin]

I currently have a T42 on my desk running Windows XP and I set up the fingerprint authentication. It took about 5 minutes. Here's how it works:

When configuring the system, you provide original prints from any number of your fingers. It suggests you provide 2 of them. Then, you just have to slowly pass any of the fingers on the sensor for it to authenticate you. So for instance, you could make sure you have an electronic print of your right index finger and of your left ring finger. I suppose the redundancy is meant to make sure you have a back-up the day you nicked you finger doing DIY during the week-end.

If you want to change the print (the same way as you would change password), you just remove some existing prints from the authentication DB and replace them with new ones. Then you just have to remember what finger to use this week.

Finally, there is always the solution to press CTRL-ATL-DEL to get a normal password prompt.

So, all in all, the way it is implemented in Windows is not as a substitute to the standard password authentication but as an extension that makes it easier for you, the owner of the machine, to log in but not more difficult for a third party to do so.

I quite like the way it's implemented on Windows but it would be nice if its use could be extended to provide digital signatures and authentication to other systems, such as a Firefox plug-in.

I forgot to mention: the Windows XP implementation doesn't come out of the box. It's an IBM extension that is provided with the T42.

use the foot luke

[sgt scrub]

Am I the only one thinking outside of the shoe? We leave fingerprints all over the place -- drinking glass, doornobs, eyeglasses. When they create a device that you can stick your foot in for authentication.

ewe sorry, this is going in the wrong direction.

Biometrics are not as secure as most think!

[markdj]

Those who think biometrics are better than password systems, ought to think twice. While passwords can be changed when compromised, biometrics cannot.

There is a scene in a James Bond movie where JB uses a glass eyeball that has someone's retina pattern in it to gain access to a secure building. Also, all biometrics must be converted to some digital pattern. How long will it be before some malicious person gets these digital patterns and figures out how to plug them into the software that authenticates the biometrics thereby bypassing the reader?

Once compromised, you can't change your fingerprint or retina!