4 ms·

I'm not sure what qualifies as "lacking" but fingerprint unlock is definitely a thing in Linux. I set it up on my IBM laptop over a decade ago. These days, th

I'm not sure what qualifies as "lacking" but fingerprint unlock is definitely a thing in Linux. I set it up on my IBM laptop over a decade ago. These days, the interface even appears to have improved somewhat, to the point where there's nice GUIs and everything. https://help.ubuntu.com/stable/ubuntu-help/session-fingerprint.html.en https://help.ubuntu.com/stable/ubuntu-help/session-fingerpri... Also, dongle support is pretty good for things like java PIV cards and yubikeys. I've successfully used a java chip card with website authentication in Firefox, and with VMWare view client. This has also worked for at least a decade or more - my main issue was with process in Firefox being a little convoluted and VMWare using out of date libraries and having a set of installer instructions that actually require explicit symlinking of the a system library. But that's not really linux's fault.

jeroenhd 4y ago
Fingerprints work great in modern Linux distros (I use them for sudo and sometimes unlocking my display), but the fingerprint hardware and the TPM don't seem to talk to each other. Windows Hello (and I presume TouchID) is set up to handle authentication and authorization together in one well-secured kernel blob with all kinds of TPM trickery to ensure security. The Linux version of this process, at least as far as I could find so far, consists of identifying and authorizing the user alright, but the TPM's secret management seems to be handled by an entirely different system. This means that brute-forcing or other attempts at access don't need to go through the biometric system on Linux whereas Windows Hello is more tightly protected against malware like that. Dongles do work great! With WebAuthn/FIDO(2) we can hopefully soon start to let go of password managers completely. Passwords are useful but passwordless authentication is just better for most single factor authentication mechanisms in my opinion.
- capitainenemo 4y ago
  I had no particular desire to use TPM thus far, but you're right, searching briefly on this, it seems the tcscd daemon written by IBM provided by the "trousers" project does not seem to have any PAM integration. That said, presumably you could plug the 2 together (pam and tcscd) with some random script, right? Sure, that doesn't avoid the brute force scenario, but if it's just to store some ridiculously long random key so you don't have to type it in, it's not going to get brute forced anyway. (although in that case, why bother with the TPM?) As for eliminating passwords, while I love the idea of hardware dongles, I'm always going to want to have a password on it.. I assume you mean eliminating having a ton of passwords as opposed to one good strong password on the dongle. But then, that's the same situation I'm in with the password managers anyway. It's not like I actually type my password into most websites anymore...
  - jeroenhd 4y ago
    I think it could work, but I wouldn't want to protect my banking passwords and credit card details behind some random script. What I mean is eliminating passwords on most services at all. For everything but real important stuff (banks, email, business accounts, that kind of stuff), I reckon my devices are protected enough that if someone can gain access to my devices unlocked enough, 2FA wouldn't prevent any threads anyway. Passwords are easy to brute force, but device-bound keys aren't. Using the security chips inside my devices for authentication as a single factor is more than enough for most of my purposes. Today, most websites offer FIDO2/WebAuthn/U2F as a second factor, but I'd rather see them as a first factor with an optional password as a second factor. My password manager protects me against nothing more than brute forcing and password reuse. Switching to TPM-first moves the protected bastion from a piece of software running in userland to either a kernel level-protected component or a dedicated piece of hardware. There's only so much you can do as a desktop application to protect your users' keys, after all. I wouldn't want to force anyone into this system, but I do think with the hype FIDO2 was released with, I imagine browsers are going to push more for using FIDO2 as a primary factor where available.
    - capitainenemo 4y ago
      Yeah, I understand... but follow me here. If I'm using a 50 character randomly generated password on a website using my typical ({a..k} {m..z} {A..H} {J..N} {P..Z} {2..9}) token generation, then they are going to be brute forcing 6×10⁸⁷ combinations right? That's not happening. So. Randomly generated passwords for sites, managed by a password manager, are much like device bound keys, but with the added advantage that I can still type it into something that doesn't support the device if I really need to... I still like the idea of dongles especially to enhance the master password. I just don't see what it wins me over a random site password. And, I'm absolutely going to have a password on my dongle or laptop in case of loss. I don't really trust biometrics in that scenario either really. Especially fingerprints that would be all over the laptop. Biometrics are just a convenience that I recognise offers some modicum of security. That's why hooking it up to TPM seems to not add much. ... I do get hardening where the passwords are stored though... although, if the disc is encrypted using TPM (which linux definitely supports), I guess the main attack you'd be concerned about would be the OS being compromised while running, but aren't we just back to loggers then?

jeroenhd 4y ago

Fingerprints work great in modern Linux distros (I use them for sudo and sometimes unlocking my display), but the fingerprint hardware and the TPM don't seem to talk to each other. Windows Hello (and I presume TouchID) is set up to handle authentication and authorization together in one well-secured kernel blob with all kinds of TPM trickery to ensure security. The Linux version of this process, at least as far as I could find so far, consists of identifying and authorizing the user alright, but the TPM's secret management seems to be handled by an entirely different system. This means that brute-forcing or other attempts at access don't need to go through the biometric system on Linux whereas Windows Hello is more tightly protected against malware like that. Dongles do work great! With WebAuthn/FIDO(2) we can hopefully soon start to let go of password managers completely. Passwords are useful but passwordless authentication is just better for most single factor authentication mechanisms in my opinion.

capitainenemo 4y ago
I had no particular desire to use TPM thus far, but you're right, searching briefly on this, it seems the tcscd daemon written by IBM provided by the "trousers" project does not seem to have any PAM integration. That said, presumably you could plug the 2 together (pam and tcscd) with some random script, right? Sure, that doesn't avoid the brute force scenario, but if it's just to store some ridiculously long random key so you don't have to type it in, it's not going to get brute forced anyway. (although in that case, why bother with the TPM?) As for eliminating passwords, while I love the idea of hardware dongles, I'm always going to want to have a password on it.. I assume you mean eliminating having a ton of passwords as opposed to one good strong password on the dongle. But then, that's the same situation I'm in with the password managers anyway. It's not like I actually type my password into most websites anymore...
- jeroenhd 4y ago
  I think it could work, but I wouldn't want to protect my banking passwords and credit card details behind some random script. What I mean is eliminating passwords on most services at all. For everything but real important stuff (banks, email, business accounts, that kind of stuff), I reckon my devices are protected enough that if someone can gain access to my devices unlocked enough, 2FA wouldn't prevent any threads anyway. Passwords are easy to brute force, but device-bound keys aren't. Using the security chips inside my devices for authentication as a single factor is more than enough for most of my purposes. Today, most websites offer FIDO2/WebAuthn/U2F as a second factor, but I'd rather see them as a first factor with an optional password as a second factor. My password manager protects me against nothing more than brute forcing and password reuse. Switching to TPM-first moves the protected bastion from a piece of software running in userland to either a kernel level-protected component or a dedicated piece of hardware. There's only so much you can do as a desktop application to protect your users' keys, after all. I wouldn't want to force anyone into this system, but I do think with the hype FIDO2 was released with, I imagine browsers are going to push more for using FIDO2 as a primary factor where available.
  - capitainenemo 4y ago
    Yeah, I understand... but follow me here. If I'm using a 50 character randomly generated password on a website using my typical ({a..k} {m..z} {A..H} {J..N} {P..Z} {2..9}) token generation, then they are going to be brute forcing 6×10⁸⁷ combinations right? That's not happening. So. Randomly generated passwords for sites, managed by a password manager, are much like device bound keys, but with the added advantage that I can still type it into something that doesn't support the device if I really need to... I still like the idea of dongles especially to enhance the master password. I just don't see what it wins me over a random site password. And, I'm absolutely going to have a password on my dongle or laptop in case of loss. I don't really trust biometrics in that scenario either really. Especially fingerprints that would be all over the laptop. Biometrics are just a convenience that I recognise offers some modicum of security. That's why hooking it up to TPM seems to not add much. ... I do get hardening where the passwords are stored though... although, if the disc is encrypted using TPM (which linux definitely supports), I guess the main attack you'd be concerned about would be the OS being compromised while running, but aren't we just back to loggers then?