6 ms·

Why does Gnome fingerprint unlock not unlock the keyring?

104 points by ingve 3y ago

baybal2 3y ago
> And that's the difference. When you perform TouchID authentication, the secure enclave can decide to release a secret that can be used to decrypt your keyring. We can't easily do this under Linux because we don't have an interface to store those secrets. > The secret material can't just be stored on disk - that would allow anyone who had access to the disk to use that material to decrypt the keyring and get access to the passwords, defeating the object. I'll provide a broader explanation: you cannot encrypt your key with a fingerprint. A genuine "throw away the key" lock is only possible when the decryption key is completely erased from memory during the screen lock, and you cannot use your fingerprint or face image as a key by itself. A screen lock using stored secret is inherently incapable of providing encryption at rest. It's like a password on a sticky note. A "throw away the key" is only possible with a password, or a smartcard.
- parker_mountain 3y ago
  I'm not sure if you're familiar with how Touch ID and the secure enclave works?
- mjg59 3y ago
  If you trust the hardware then it's entirely possible to tie the release of an encryption key to a fingerprint validated by that hardware. Hardware-backed keys are widely used (the entire WebAuthn ecosystem is predicated upon them being trustworthy), and having that hardware validate a fingerprint rather than merely physical presence is an improvement.
  - RockRobotRock 3y ago
    As far as physical attacks go, we only trust secure elements because they're tiny and very difficult to reverse engineer, right?
    - mjg59 3y ago
      In theory you could potentially decap the enclave and read data out of it but you would need extremely high end equipment to do that and it would be obviously destructive so it's not in most people's threat model
    - g_p 3y ago
      Partly that, and partly because they were/are built with constrained functionality (do one thing well) that significantly limits the interfaces exposed, and are designed to be secure under the assumption of physical attack (which most things aren't!) Partly because many secure enclave type applications have undergone formal verification and verification through something like CC EAL, which should reduce the likelihood of glaring oversights etc. One final aspect, more for hardware enclaves though, is that they're often designed specifically to resist the kinds of physical attacks people may try - as security products, they've very likely considered power rail glitching and how to reset the enclave if there's a glitch. Similarly, the physical ICs may be produced with physical features to try to prevent successfully decapping the chip, like sensing wires you'll disrupt, and inbuilt EM shielding.
    - baybal2 3y ago
      [dead]
  - westurner 3y ago
    https://news.ycombinator.com/item?id=33311523 https://news.ycombinator.com/item?id=33311523 : > [WebAuthn, TPM, U2F/FIDO2, Seahorse,] > tpm-fido: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido : >> tpm-fido is FIDO token implementation for Linux that protects the token keys by using your system's TPM. tpm-fido uses Linux's uhid facility to emulate a USB HID device so that it is properly detected by browsers. TPM > TPM software libraries: https://en.wikipedia.org/wiki/Trusted_Platform_Module#TPM_software_libraries https://en.wikipedia.org/wiki/Trusted_Platform_Module#TPM_so... TPM > Virtualization; virtual TPM devices: https://en.wikipedia.org/wiki/Trusted_Platform_Module#Virtualization https://en.wikipedia.org/wiki/Trusted_Platform_Module#Virtua... WebAuthn: https://en.wikipedia.org/wiki/WebAuthn https://en.wikipedia.org/wiki/WebAuthn
mrintegrity 3y ago
I was wondering that myself, and just this moment tested it. Interestingly, I pressed cancel on the keyring dialog instead of entering a password.. everything seems to work fine!? I can view saved passwords for wifi networks in gnome network manager, firefox passwords can be viewed in it's manager too. So what exactly does this system protect? It seems I have either misunderstood it's functionality or it's completely broken. Is it literally only protecting the "login keyring", in which case what is the point when I can still login and seemingly do everything anyway? In the gui "seahorse" I can view all openssh and gpg keys without having unlocked the login keyring.. very confused by this!
- oynqr 3y ago
  NetworkManager can save credentials for all users, which is probably your case, and the others don't use the system keyring by default.
- yrro 3y ago
  > I can view saved passwords for wifi networks in gnome network manager, These are stored system-wide, within NM's connection profiles (likely /etc/NetworkManager/system-connections/whatever.nmconnection). > In the gui "seahorse" I can view all openssh and gpg keys without having unlocked the login keyring This is unlocked when you first log in, or unlock your session (pam_gnome_keyring.so stashes the password when called from 'auth' and retrieves it & uses it to unlock the user's keyring when called from 'session'); but I don't believe the keyring is locked when the session is locked, only when the system suspends/hibernates.
- Karliss 3y ago
  OpenSSH keys have their own passwords. On my system there are a few things that are stored within login keyring: chromium safe storage for various electron based programs (Chromium itself, discord, vscode, unity hub), password or login token for Element (matrix client), svn password, login credentials for VM which was created using Gnome Boxes. All of which might be a software that you don't use or use in different configuration. But since I don't have a fingerprint reader i can't verify that those things wouldn't work when logging in without password. Edit: as a test I deleted the secrets stored by discord and Element, after restarting the programs both of them were able to login without reentering password. So while they are storing something within login keyring, it doesn't seem to be anything important, and actual credentials are stored elsewhere.
3np 3y ago
Theoretically, if using the "it passes a graphical representation of the fingerprint back to the OS" models, it could be done if assuming a method to reliably derive strong cryptographic keys from a fingerprint scan. Reliably mapping to the same key while not dropping down to abysmal entropy probably makes this intractably, hence the need for a TPM.
knallfrosch 3y ago
This doesn't explain why Linux doesn't communicate with the secure enclave. Edit: I suspect closed-source hardware drivers, or collaboration with manufacturer is needed - so no fault on the Linux team, but still, an explanation as part of the article would be welcome. As an aside, Appleland isn't the promised land either. Apple laptops with a fingerprint reader lack the interface to be unlocked with depth cameras, like any Windows Hello certified camera. This means biometric authentication requires another connected fingerprint reader when the lid is closed. Apple phones on the other hand have the opposite problem. They have a depth camera and can use your face to unlock, but lack the hardware for fingerprint unlocking. This means you have to lift them up and point them at your face while other phones have built-in fingerprint readers beneath their screens.
- ho_schi 3y ago
  The cameras - i.e. FaceID - on the iPhone are unlocking the iPhone prematurely (to early). Why? Because they unlock the device in advance before you request it by action. Watch the small lock. It unlocks before you swipe up. Example? You ask a stranger to take a photo of your group. I think a normal situation. Not an issue with an iPhone SE (1st Gen - 3rd Gen). Just open the camera app from the lock screen and pass it, the photographer just needs to know “red button” and cannot access anything. Same with FaceID? You’re likely in trouble because you probably didn’t covered the front camera while passing the smartphone - it is completely unlocked because FaceID unlocks the device as soon as it recognizes the you. Apple has broken a security promise which we all know and expect. And usually the screen turns on when the phone is picked up (FaceID starts searching) and even if not - by habit many will touch the side-button and launch the camera app from the lock—screen. Workaround? Turn FaceID off. Or always remember not to look at the device and cover cameras with your fingers (FaceID can be quick). Guess what? Only the first one works for me. Previously? Stealing an iPhone handed over for photography was useless. Investigating private data was not possible. Please note that an unlocked iPhone allows access to all data. And resetting your passwords via E-Mail. I don’t know if the E-Mail is enough to reset the Apple ID. I’m afraid FaceID was considered too slow by Apple and they decided to make it “feel faster” by scanning for the owner already before the owner swipes up to unlock. It could be secure - only unlock if the user actually requests it by swiping up. The tiny “lock icon” also part of the problem. Within iOS itself a use of FaceID is much more obvious, users note when it is happening. PS: GNOME and seahorse are nice - when you login in with password it is automatically unlocked. It handles changes of the password also through the shell well, it recognizes the mismatch and ask only once for the old password. Maybe the reason why I didn’t feel the need for “password managers”.
bandrami 3y ago
This would only work if you could somehow reliably produce a predictable string of some sort from the scan of a fingerprint, but you can't. Unless it's decrypting the keychain by an artifact of the scanning process itself, the password is stored and available somewhere on the computer, in a "secure enclave" or not. And I don't want that. If the finger scanner is just the warden of something that has the power to unlock the keychain without the password that is only stored in my grey cells, then someone can shim a fake finger scanner that pretends to have found a match.
- ycombinatrix 3y ago
  biometric yubikey seems to be a viable solution
- deleted 3y ago
  [deleted]
- captainmuon 3y ago
  There are protocols that you can use to authenticate the fingerprint scanner [1]. When they are not used you can indeed just shim a fake scanner and unlock the PC [2]. This all assumes that nobody can break into the secure silicone of the the fingerprint scanner (or the PC) of course, but that is a pretty high bar. [1] https://github.com/microsoft/SecureDeviceConnectionProtocol https://github.com/microsoft/SecureDeviceConnectionProtocol [2] https://www.theverge.com/2023/11/22/23972220/microsoft-windows-hello-fingerprint-authentication-bypass-security-vulnerability https://www.theverge.com/2023/11/22/23972220/microsoft-windo...
captainmuon 3y ago
Couldn't you have a small (meaning auditable) priviliged daemon store the keys in RAM when the keychain is unlocked once? The daemon would then release the keys when it determines that the fingerprint is correct. You would have to compare the fingerprints on the PC, or you would have to have a authenticated channel between the fingerprint reader and the PC, otherwise you would open yourself to device spoofing attacks. I think an attack like that was discovered recently for Windows notebooks. This scheme would mean that root can access your keys without the fingerprint (unlike on a Mac I think), but the root account already has other ways to get your passwords. Similar, you might be vulnerable against an attack where somebody confiscates your locked PC, freezes your RAM modules, and reads them out later. But you could encrypt the passwords in locked state using the TPM to make this much more difficult. And again, people who can do these attacks have much easier ways of getting your passwords, such as rootkits, or simply forcing you to put your finger on the sensor.
- mjg59 3y ago
  How are the secrets kept secret? If the encryption key is stored on disk then giving me physical access lets me extract that and gain all the secrets. The TPM has no knowledge of the biometric state so doesn't help here.
  - Sebb767 3y ago
    I think OP means that you enter your password to unencrypt your keyring once at boot or first use and then keep the keys in RAM. So you could not access the data when you steal the laptop while powered off, making it practically as safe as full-disk encryption.
    - AgentME 3y ago
      That would be as good as full-disk encryption, but it is possible and useful to do better than that with a TPM. With physical access to a running machine, it is possible to physically extract data from RAM. Law enforcement agencies even have hotplug devices that let them switch a running computer to battery power so they can seize it while keeping it on and do this.
arianvanp 3y ago
Yet Microsoft unlocks the Keyring with the exact same fingerprint readers. Microsoft pushed the reader industry to adopt their protocol almost 6 years ago and it's universally implemented in almost all laptops (citation needed; maybe I'm wrong here and it's not as universal). They even have an open source reference implementation - https://github.com/microsoft/SecureDeviceConnectionProtocol https://github.com/microsoft/SecureDeviceConnectionProtocol - https://github.com/Microsoft/SecureDeviceConnectionProtocol/wiki/Secure-Device-Connection-Protocol https://github.com/Microsoft/SecureDeviceConnectionProtocol/... Yet Fprintd still doesn't support it to date. https://gitlab.freedesktop.org/libfprint/libfprint/-/issues/257 https://gitlab.freedesktop.org/libfprint/libfprint/-/issues/... So the problem really isn't with the fingerprint readers (at least on modern laptops) it's that fprintd is horribly outdated with current tech The other problem with Linux is that SDCP needs to be implemented in tandem with TPM support. Another area where Linux Distros are at least 10 years behind Windows. However systemd has been slowly making strides with PCRLock I am also pretty sure (but citation needed) that Microsoft has fallback code for image-matching fingerprint readers that run that code in a VM in some kind of trusted execution environment so that Windows Hello also works on old fingerprint readers
- hulitu 3y ago
  > Another area where Linux Distros are at least 10 years behind Windows. I don't think that my computer requires a fingerprint sensor to function.
- noja 3y ago
  > it's that fprintd is horribly outdated with current tech This current tech? https://www.theregister.com/2023/11/22/windows_hello_fingerprint_bypass/ https://www.theregister.com/2023/11/22/windows_hello_fingerp...
  - arjvik 3y ago
    If an attacker has physical access long enough to connect a MITM on your fingerprint reader, it's not your laptop anymore.
AshamedCaptain 3y ago
Typical over engineering that would worry about stealing the encrypted hard disk when discussing about a fingerprint scanner that would only really take a couple minutes to fool for the determined attacker... When did we forget that biometrics were supposed to be a convenience and not a replacement for true authentication against any real adversary? As the entire concept of using irreplaceable parts of yourself as key is broken since the start... Who is the adversary here? The point of all this is to at best protect against untrained thief, but with biometrics, never against anything more...
- thaumasiotes 3y ago
  > When did we forget that biometrics were supposed to be a convenience and not a replacement for true authentication against any real adversary? Before the first guy started implementing biometric unlock. If you can use it to unlock things, then it is an upper bound on the security level for whatever it can unlock. > As the entire concept of using irreplaceable parts of yourself as key is broken since the start... Yes, obviously. A password that can never be changed is a huge security downgrade from a normal password.
fsckboy 3y ago
just an interesting side point, your fingerprint lives persistently in the fingerprint reader, rather than "in your computer": by analogy, what I mean is something like, "if your fingerprint reader is in your mouse, then your fingerprint lives in your mouse, not at the other end of the wire plugged into the computer." I know this because I own a bunch of Thinkpads and I swapped out a keyboard for one that had been unused for several years, and my fingerprint came back piggyback. I had to configure the password change, but I didn't have to retrain it on my fingerprint. (the fingerprint reader circuit board lives right under the touchspot, and plugs into the motherboard via a short cable; the motherboard and OS installed had no notion of fingerprints before this because the keyboard I swapped out did not have a fingerprint reader) Not sure if that's a security issue for discarded hardware? but I found it quite strange.
mcpackieh 3y ago
Simply put: The intersection of "values Linux", "has the technical chops to implement it" and "thinks using fingerprints is actually a good idea" is an empty set. Maybe some people in this thread think they're in that intersection, but I don't think anybody actually is.
- freedomben 3y ago
  I would put myself in that set, but it depends on what you want to use the fingerprint for whether it's a good idea. I prefer things exactly as they are currently. I don't want my fingerprint reader to be able to unlock the keychain. However, I do use it for quickly unlocking a laptop who's keychain is already unlocked. I do this probably 10 to 15 times a day. If I had to type my long-ass password every single time, then I start to not want to lock the laptop if I'm only running to the bathroom or something, which is a very bad practice.
  - mcpackieh 3y ago
    Okay, fair. I should have said: "thinks using fingerprints [to unlock their keychain] is actually a good idea"

104 points by ingve 3y ago

> And that's the difference. When you perform TouchID authentication, the secure enclave can decide to release a secret that can be used to decrypt your keyring. We can't easily do this under Linux because we don't have an interface to store those secrets. > The secret material can't just be stored on disk - that would allow anyone who had access to the disk to use that material to decrypt the keyring and get access to the passwords, defeating the object. I'll provide a broader explanation: you cannot encrypt your key with a fingerprint. A genuine "throw away the key" lock is only possible when the decryption key is completely erased from memory during the screen lock, and you cannot use your fingerprint or face image as a key by itself. A screen lock using stored secret is inherently incapable of providing encryption at rest. It's like a password on a sticky note. A "throw away the key" is only possible with a password, or a smartcard.

parker_mountain 3y ago
I'm not sure if you're familiar with how Touch ID and the secure enclave works?
mjg59 3y ago
If you trust the hardware then it's entirely possible to tie the release of an encryption key to a fingerprint validated by that hardware. Hardware-backed keys are widely used (the entire WebAuthn ecosystem is predicated upon them being trustworthy), and having that hardware validate a fingerprint rather than merely physical presence is an improvement.
- RockRobotRock 3y ago
  As far as physical attacks go, we only trust secure elements because they're tiny and very difficult to reverse engineer, right?
  - mjg59 3y ago
    In theory you could potentially decap the enclave and read data out of it but you would need extremely high end equipment to do that and it would be obviously destructive so it's not in most people's threat model
  - g_p 3y ago
    Partly that, and partly because they were/are built with constrained functionality (do one thing well) that significantly limits the interfaces exposed, and are designed to be secure under the assumption of physical attack (which most things aren't!) Partly because many secure enclave type applications have undergone formal verification and verification through something like CC EAL, which should reduce the likelihood of glaring oversights etc. One final aspect, more for hardware enclaves though, is that they're often designed specifically to resist the kinds of physical attacks people may try - as security products, they've very likely considered power rail glitching and how to reset the enclave if there's a glitch. Similarly, the physical ICs may be produced with physical features to try to prevent successfully decapping the chip, like sensing wires you'll disrupt, and inbuilt EM shielding.
  - baybal2 3y ago
    [dead]
- westurner 3y ago
  https://news.ycombinator.com/item?id=33311523 https://news.ycombinator.com/item?id=33311523 : > [WebAuthn, TPM, U2F/FIDO2, Seahorse,] > tpm-fido: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido : >> tpm-fido is FIDO token implementation for Linux that protects the token keys by using your system's TPM. tpm-fido uses Linux's uhid facility to emulate a USB HID device so that it is properly detected by browsers. TPM > TPM software libraries: https://en.wikipedia.org/wiki/Trusted_Platform_Module#TPM_software_libraries https://en.wikipedia.org/wiki/Trusted_Platform_Module#TPM_so... TPM > Virtualization; virtual TPM devices: https://en.wikipedia.org/wiki/Trusted_Platform_Module#Virtualization https://en.wikipedia.org/wiki/Trusted_Platform_Module#Virtua... WebAuthn: https://en.wikipedia.org/wiki/WebAuthn https://en.wikipedia.org/wiki/WebAuthn

mrintegrity 3y ago

I was wondering that myself, and just this moment tested it. Interestingly, I pressed cancel on the keyring dialog instead of entering a password.. everything seems to work fine!? I can view saved passwords for wifi networks in gnome network manager, firefox passwords can be viewed in it's manager too. So what exactly does this system protect? It seems I have either misunderstood it's functionality or it's completely broken. Is it literally only protecting the "login keyring", in which case what is the point when I can still login and seemingly do everything anyway? In the gui "seahorse" I can view all openssh and gpg keys without having unlocked the login keyring.. very confused by this!

oynqr 3y ago
NetworkManager can save credentials for all users, which is probably your case, and the others don't use the system keyring by default.
yrro 3y ago
> I can view saved passwords for wifi networks in gnome network manager, These are stored system-wide, within NM's connection profiles (likely /etc/NetworkManager/system-connections/whatever.nmconnection). > In the gui "seahorse" I can view all openssh and gpg keys without having unlocked the login keyring This is unlocked when you first log in, or unlock your session (pam_gnome_keyring.so stashes the password when called from 'auth' and retrieves it & uses it to unlock the user's keyring when called from 'session'); but I don't believe the keyring is locked when the session is locked, only when the system suspends/hibernates.
Karliss 3y ago
OpenSSH keys have their own passwords. On my system there are a few things that are stored within login keyring: chromium safe storage for various electron based programs (Chromium itself, discord, vscode, unity hub), password or login token for Element (matrix client), svn password, login credentials for VM which was created using Gnome Boxes. All of which might be a software that you don't use or use in different configuration. But since I don't have a fingerprint reader i can't verify that those things wouldn't work when logging in without password. Edit: as a test I deleted the secrets stored by discord and Element, after restarting the programs both of them were able to login without reentering password. So while they are storing something within login keyring, it doesn't seem to be anything important, and actual credentials are stored elsewhere.

3np 3y ago

Theoretically, if using the "it passes a graphical representation of the fingerprint back to the OS" models, it could be done if assuming a method to reliably derive strong cryptographic keys from a fingerprint scan. Reliably mapping to the same key while not dropping down to abysmal entropy probably makes this intractably, hence the need for a TPM.

knallfrosch 3y ago

This doesn't explain why Linux doesn't communicate with the secure enclave. Edit: I suspect closed-source hardware drivers, or collaboration with manufacturer is needed - so no fault on the Linux team, but still, an explanation as part of the article would be welcome. As an aside, Appleland isn't the promised land either. Apple laptops with a fingerprint reader lack the interface to be unlocked with depth cameras, like any Windows Hello certified camera. This means biometric authentication requires another connected fingerprint reader when the lid is closed. Apple phones on the other hand have the opposite problem. They have a depth camera and can use your face to unlock, but lack the hardware for fingerprint unlocking. This means you have to lift them up and point them at your face while other phones have built-in fingerprint readers beneath their screens.

ho_schi 3y ago
The cameras - i.e. FaceID - on the iPhone are unlocking the iPhone prematurely (to early). Why? Because they unlock the device in advance before you request it by action. Watch the small lock. It unlocks before you swipe up. Example? You ask a stranger to take a photo of your group. I think a normal situation. Not an issue with an iPhone SE (1st Gen - 3rd Gen). Just open the camera app from the lock screen and pass it, the photographer just needs to know “red button” and cannot access anything. Same with FaceID? You’re likely in trouble because you probably didn’t covered the front camera while passing the smartphone - it is completely unlocked because FaceID unlocks the device as soon as it recognizes the you. Apple has broken a security promise which we all know and expect. And usually the screen turns on when the phone is picked up (FaceID starts searching) and even if not - by habit many will touch the side-button and launch the camera app from the lock—screen. Workaround? Turn FaceID off. Or always remember not to look at the device and cover cameras with your fingers (FaceID can be quick). Guess what? Only the first one works for me. Previously? Stealing an iPhone handed over for photography was useless. Investigating private data was not possible. Please note that an unlocked iPhone allows access to all data. And resetting your passwords via E-Mail. I don’t know if the E-Mail is enough to reset the Apple ID. I’m afraid FaceID was considered too slow by Apple and they decided to make it “feel faster” by scanning for the owner already before the owner swipes up to unlock. It could be secure - only unlock if the user actually requests it by swiping up. The tiny “lock icon” also part of the problem. Within iOS itself a use of FaceID is much more obvious, users note when it is happening. PS: GNOME and seahorse are nice - when you login in with password it is automatically unlocked. It handles changes of the password also through the shell well, it recognizes the mismatch and ask only once for the old password. Maybe the reason why I didn’t feel the need for “password managers”.

bandrami 3y ago

This would only work if you could somehow reliably produce a predictable string of some sort from the scan of a fingerprint, but you can't. Unless it's decrypting the keychain by an artifact of the scanning process itself, the password is stored and available somewhere on the computer, in a "secure enclave" or not. And I don't want that. If the finger scanner is just the warden of something that has the power to unlock the keychain without the password that is only stored in my grey cells, then someone can shim a fake finger scanner that pretends to have found a match.

ycombinatrix 3y ago
biometric yubikey seems to be a viable solution
deleted 3y ago
[deleted]
captainmuon 3y ago
There are protocols that you can use to authenticate the fingerprint scanner [1]. When they are not used you can indeed just shim a fake scanner and unlock the PC [2]. This all assumes that nobody can break into the secure silicone of the the fingerprint scanner (or the PC) of course, but that is a pretty high bar. [1] https://github.com/microsoft/SecureDeviceConnectionProtocol https://github.com/microsoft/SecureDeviceConnectionProtocol [2] https://www.theverge.com/2023/11/22/23972220/microsoft-windows-hello-fingerprint-authentication-bypass-security-vulnerability https://www.theverge.com/2023/11/22/23972220/microsoft-windo...

captainmuon 3y ago

Couldn't you have a small (meaning auditable) priviliged daemon store the keys in RAM when the keychain is unlocked once? The daemon would then release the keys when it determines that the fingerprint is correct. You would have to compare the fingerprints on the PC, or you would have to have a authenticated channel between the fingerprint reader and the PC, otherwise you would open yourself to device spoofing attacks. I think an attack like that was discovered recently for Windows notebooks. This scheme would mean that root can access your keys without the fingerprint (unlike on a Mac I think), but the root account already has other ways to get your passwords. Similar, you might be vulnerable against an attack where somebody confiscates your locked PC, freezes your RAM modules, and reads them out later. But you could encrypt the passwords in locked state using the TPM to make this much more difficult. And again, people who can do these attacks have much easier ways of getting your passwords, such as rootkits, or simply forcing you to put your finger on the sensor.

mjg59 3y ago
How are the secrets kept secret? If the encryption key is stored on disk then giving me physical access lets me extract that and gain all the secrets. The TPM has no knowledge of the biometric state so doesn't help here.
- Sebb767 3y ago
  I think OP means that you enter your password to unencrypt your keyring once at boot or first use and then keep the keys in RAM. So you could not access the data when you steal the laptop while powered off, making it practically as safe as full-disk encryption.
  - AgentME 3y ago
    That would be as good as full-disk encryption, but it is possible and useful to do better than that with a TPM. With physical access to a running machine, it is possible to physically extract data from RAM. Law enforcement agencies even have hotplug devices that let them switch a running computer to battery power so they can seize it while keeping it on and do this.

arianvanp 3y ago

Yet Microsoft unlocks the Keyring with the exact same fingerprint readers. Microsoft pushed the reader industry to adopt their protocol almost 6 years ago and it's universally implemented in almost all laptops (citation needed; maybe I'm wrong here and it's not as universal). They even have an open source reference implementation - https://github.com/microsoft/SecureDeviceConnectionProtocol https://github.com/microsoft/SecureDeviceConnectionProtocol - https://github.com/Microsoft/SecureDeviceConnectionProtocol/wiki/Secure-Device-Connection-Protocol https://github.com/Microsoft/SecureDeviceConnectionProtocol/... Yet Fprintd still doesn't support it to date. https://gitlab.freedesktop.org/libfprint/libfprint/-/issues/257 https://gitlab.freedesktop.org/libfprint/libfprint/-/issues/... So the problem really isn't with the fingerprint readers (at least on modern laptops) it's that fprintd is horribly outdated with current tech The other problem with Linux is that SDCP needs to be implemented in tandem with TPM support. Another area where Linux Distros are at least 10 years behind Windows. However systemd has been slowly making strides with PCRLock I am also pretty sure (but citation needed) that Microsoft has fallback code for image-matching fingerprint readers that run that code in a VM in some kind of trusted execution environment so that Windows Hello also works on old fingerprint readers

hulitu 3y ago
> Another area where Linux Distros are at least 10 years behind Windows. I don't think that my computer requires a fingerprint sensor to function.
noja 3y ago
> it's that fprintd is horribly outdated with current tech This current tech? https://www.theregister.com/2023/11/22/windows_hello_fingerprint_bypass/ https://www.theregister.com/2023/11/22/windows_hello_fingerp...
- arjvik 3y ago
  If an attacker has physical access long enough to connect a MITM on your fingerprint reader, it's not your laptop anymore.

AshamedCaptain 3y ago

Typical over engineering that would worry about stealing the encrypted hard disk when discussing about a fingerprint scanner that would only really take a couple minutes to fool for the determined attacker... When did we forget that biometrics were supposed to be a convenience and not a replacement for true authentication against any real adversary? As the entire concept of using irreplaceable parts of yourself as key is broken since the start... Who is the adversary here? The point of all this is to at best protect against untrained thief, but with biometrics, never against anything more...

thaumasiotes 3y ago
> When did we forget that biometrics were supposed to be a convenience and not a replacement for true authentication against any real adversary? Before the first guy started implementing biometric unlock. If you can use it to unlock things, then it is an upper bound on the security level for whatever it can unlock. > As the entire concept of using irreplaceable parts of yourself as key is broken since the start... Yes, obviously. A password that can never be changed is a huge security downgrade from a normal password.

fsckboy 3y ago

just an interesting side point, your fingerprint lives persistently in the fingerprint reader, rather than "in your computer": by analogy, what I mean is something like, "if your fingerprint reader is in your mouse, then your fingerprint lives in your mouse, not at the other end of the wire plugged into the computer." I know this because I own a bunch of Thinkpads and I swapped out a keyboard for one that had been unused for several years, and my fingerprint came back piggyback. I had to configure the password change, but I didn't have to retrain it on my fingerprint. (the fingerprint reader circuit board lives right under the touchspot, and plugs into the motherboard via a short cable; the motherboard and OS installed had no notion of fingerprints before this because the keyboard I swapped out did not have a fingerprint reader) Not sure if that's a security issue for discarded hardware? but I found it quite strange.

mcpackieh 3y ago

Simply put: The intersection of "values Linux", "has the technical chops to implement it" and "thinks using fingerprints is actually a good idea" is an empty set. Maybe some people in this thread think they're in that intersection, but I don't think anybody actually is.

freedomben 3y ago
I would put myself in that set, but it depends on what you want to use the fingerprint for whether it's a good idea. I prefer things exactly as they are currently. I don't want my fingerprint reader to be able to unlock the keychain. However, I do use it for quickly unlocking a laptop who's keychain is already unlocked. I do this probably 10 to 15 times a day. If I had to type my long-ass password every single time, then I start to not want to lock the laptop if I'm only running to the bathroom or something, which is a very bad practice.
- mcpackieh 3y ago
  Okay, fair. I should have said: "thinks using fingerprints [to unlock their keychain] is actually a good idea"