9 ms·

Yet Microsoft unlocks the Keyring with the exact same fingerprint readers. Microsoft pushed the reader industry to adopt their protocol almost 6 years ago and

Yet Microsoft unlocks the Keyring with the exact same fingerprint readers. Microsoft pushed the reader industry to adopt their protocol almost 6 years ago and it's universally implemented in almost all laptops (citation needed; maybe I'm wrong here and it's not as universal). They even have an open source reference implementation - https://github.com/microsoft/SecureDeviceConnectionProtocol https://github.com/microsoft/SecureDeviceConnectionProtocol - https://github.com/Microsoft/SecureDeviceConnectionProtocol/wiki/Secure-Device-Connection-Protocol https://github.com/Microsoft/SecureDeviceConnectionProtocol/... Yet Fprintd still doesn't support it to date. https://gitlab.freedesktop.org/libfprint/libfprint/-/issues/257 https://gitlab.freedesktop.org/libfprint/libfprint/-/issues/... So the problem really isn't with the fingerprint readers (at least on modern laptops) it's that fprintd is horribly outdated with current tech The other problem with Linux is that SDCP needs to be implemented in tandem with TPM support. Another area where Linux Distros are at least 10 years behind Windows. However systemd has been slowly making strides with PCRLock I am also pretty sure (but citation needed) that Microsoft has fallback code for image-matching fingerprint readers that run that code in a VM in some kind of trusted execution environment so that Windows Hello also works on old fingerprint readers

hulitu 3y ago
> Another area where Linux Distros are at least 10 years behind Windows. I don't think that my computer requires a fingerprint sensor to function.
noja 3y ago
> it's that fprintd is horribly outdated with current tech This current tech? https://www.theregister.com/2023/11/22/windows_hello_fingerprint_bypass/ https://www.theregister.com/2023/11/22/windows_hello_fingerp...
- arjvik 3y ago
  If an attacker has physical access long enough to connect a MITM on your fingerprint reader, it's not your laptop anymore.
  - blowski 3y ago
    This line of thinking can and is used as an excuse for all sorts of security shortcomings. Yes, in threat modelling, this would be give fairly limited opportunity as an attack vector, but any successful attack could have a massive impact. It makes sense for device owners to consider this possibility in how they protect their machines, and for device manufacturers to attempt to mitigate it.
    - offices 3y ago
      No, this line of thinking is basic threat modelling and stops us wasting time and effort on navel gazing when it would be better spent on things we can control. An invasive, non-destructive physical attacker also has access to (likely unencrypted) drives, memory buses, HIDs, audiovisual inputs... 'Fixing' this doesn't make your machine any less pwned if you let them touch it.
      - blowski 3y ago
        The linked article says it's not a problem with all implementations. This would suggest device manufacturers can defend against it, but some have chosen not to. Given the choice of a laptop where this risk is mitigated and one where it isn't, all other things being equal, I'd choose the one with protections in place.
    - NoLsAfterMid 3y ago
      Ok, but none of modern computing was designed around this mentality. Virtually all computers are trivially compromisable if you have physical access to the machine.
      - quenix 3y ago
        This doesn't appear as true for the latest Apple Silicon macs. They are quite locked down by default
        NoLsAfterMid 3y ago
mjg59 3y ago
SCDP describes a driver-level API, it doesn't tell you how to talk to the actual hardware. Vendors ship Windows drivers that implement that API but I'm not aware of any who've documented it. And while SCDP provides a secure communication channel with the biometric device, in itself that doesn't give you an ability to seal secrets to that device based on the biometric data.
creshal 3y ago
My 2 year old laptop's fingerprint reader still doesn't work in Linux: Its native resolution is too high for the driver to handle, and somehow that's been an unfixable problem for years now.
mariusor 3y ago
> Another area where Linux Distros are at least 10 years behind Windows. I don't really understand the way that people who apparently should know better still frame the issue as a "Linux" problem, instead of a "hardware vendors" problem. When vendors cooperate, open-source is on par with other OSs (see AMD and Intel), but when they don't then it's amazing that things are working to the level that they do, and I am thankful.
- NoLsAfterMid 3y ago
  I don't get the distinction. Linux has to run on the hardware, no?
  - creshal 3y ago
    Linux doesn't "have" to run on the hardware. The vendors put in all the work to make the hardware work for Windows (not Microsoft); the Linux community often has to do all the work themselves (usually starting by reverse engineering hardware, due to uncooperative vendors).
    - NoLsAfterMid 3y ago
      Linux does have to run on the hardware if it wants to be used by people. Blaming vendors doesn't fix the problem or get the community anywhere. This just reeks of being blinded by pride.
      - bheadmaster 3y ago
        > Blaming vendors doesn't fix the problem or get the community anywhere. Neither does blaming Linux developers. But the fact is, Linux developers are doing their best to cooperate, while hardware vendors aren't. It's not about assigning blame, it's about describing the objective state of facts.
        thfuran 3y ago
        Saying that Linux is behind windows in some particular functionality isn't blaming developers.
rodrigodlu 3y ago
Do you know any workarounds to make Windows not ask me to login on a Ms account whenever I try to setup the fingerprints? Using my Fedora installation on a XPS Plus was plug and play, no login needed. I have a Samsung Book with Windows 11 that I can't do the same. :(
- dannyw 3y ago
  I have an Acer laptop with fingerprints and without a MS account. I entered the wrong password to a fake MSFT account and that let me create a local account. Setting up fingerprint scanning was part of the OOBE. If this isn’t possible for you, try downgrading to Win10, setting it up, and upgrading.
  - account42 3y ago
    Absurd that anyone would be ok with this kind of treatment from their OS vendor.
tinus_hn 3y ago
Take a look at how secure Microsoft’s solution really is: https://www.theverge.com/2023/11/22/23972220/microsoft-windows-hello-fingerprint-authentication-bypass-security-vulnerability https://www.theverge.com/2023/11/22/23972220/microsoft-windo...
eimrine 3y ago
> The other problem with Linux is that SDCP needs to be implemented in tandem with TPM support. Another area where Linux Distros are at least 10 years behind Windows. Let me disagree, I think this is a problem of capitalism, not Linux. TPM is a closed-source technology, defective by design.

hulitu 3y ago

> Another area where Linux Distros are at least 10 years behind Windows. I don't think that my computer requires a fingerprint sensor to function.

noja 3y ago

> it's that fprintd is horribly outdated with current tech This current tech? https://www.theregister.com/2023/11/22/windows_hello_fingerprint_bypass/ https://www.theregister.com/2023/11/22/windows_hello_fingerp...

arjvik 3y ago
If an attacker has physical access long enough to connect a MITM on your fingerprint reader, it's not your laptop anymore.
- blowski 3y ago
  This line of thinking can and is used as an excuse for all sorts of security shortcomings. Yes, in threat modelling, this would be give fairly limited opportunity as an attack vector, but any successful attack could have a massive impact. It makes sense for device owners to consider this possibility in how they protect their machines, and for device manufacturers to attempt to mitigate it.
  - offices 3y ago
    No, this line of thinking is basic threat modelling and stops us wasting time and effort on navel gazing when it would be better spent on things we can control. An invasive, non-destructive physical attacker also has access to (likely unencrypted) drives, memory buses, HIDs, audiovisual inputs... 'Fixing' this doesn't make your machine any less pwned if you let them touch it.
    - blowski 3y ago
      The linked article says it's not a problem with all implementations. This would suggest device manufacturers can defend against it, but some have chosen not to. Given the choice of a laptop where this risk is mitigated and one where it isn't, all other things being equal, I'd choose the one with protections in place.
  - NoLsAfterMid 3y ago
    Ok, but none of modern computing was designed around this mentality. Virtually all computers are trivially compromisable if you have physical access to the machine.
    - quenix 3y ago
      This doesn't appear as true for the latest Apple Silicon macs. They are quite locked down by default
      - NoLsAfterMid 3y ago

mjg59 3y ago

SCDP describes a driver-level API, it doesn't tell you how to talk to the actual hardware. Vendors ship Windows drivers that implement that API but I'm not aware of any who've documented it. And while SCDP provides a secure communication channel with the biometric device, in itself that doesn't give you an ability to seal secrets to that device based on the biometric data.

creshal 3y ago

My 2 year old laptop's fingerprint reader still doesn't work in Linux: Its native resolution is too high for the driver to handle, and somehow that's been an unfixable problem for years now.

mariusor 3y ago

> Another area where Linux Distros are at least 10 years behind Windows. I don't really understand the way that people who apparently should know better still frame the issue as a "Linux" problem, instead of a "hardware vendors" problem. When vendors cooperate, open-source is on par with other OSs (see AMD and Intel), but when they don't then it's amazing that things are working to the level that they do, and I am thankful.

NoLsAfterMid 3y ago
I don't get the distinction. Linux has to run on the hardware, no?
- creshal 3y ago
  Linux doesn't "have" to run on the hardware. The vendors put in all the work to make the hardware work for Windows (not Microsoft); the Linux community often has to do all the work themselves (usually starting by reverse engineering hardware, due to uncooperative vendors).
  - NoLsAfterMid 3y ago
    Linux does have to run on the hardware if it wants to be used by people. Blaming vendors doesn't fix the problem or get the community anywhere. This just reeks of being blinded by pride.
    - bheadmaster 3y ago
      > Blaming vendors doesn't fix the problem or get the community anywhere. Neither does blaming Linux developers. But the fact is, Linux developers are doing their best to cooperate, while hardware vendors aren't. It's not about assigning blame, it's about describing the objective state of facts.
      - thfuran 3y ago
        Saying that Linux is behind windows in some particular functionality isn't blaming developers.

rodrigodlu 3y ago

Do you know any workarounds to make Windows not ask me to login on a Ms account whenever I try to setup the fingerprints? Using my Fedora installation on a XPS Plus was plug and play, no login needed. I have a Samsung Book with Windows 11 that I can't do the same. :(

dannyw 3y ago
I have an Acer laptop with fingerprints and without a MS account. I entered the wrong password to a fake MSFT account and that let me create a local account. Setting up fingerprint scanning was part of the OOBE. If this isn’t possible for you, try downgrading to Win10, setting it up, and upgrading.
- account42 3y ago
  Absurd that anyone would be ok with this kind of treatment from their OS vendor.

tinus_hn 3y ago

Take a look at how secure Microsoft’s solution really is: https://www.theverge.com/2023/11/22/23972220/microsoft-windows-hello-fingerprint-authentication-bypass-security-vulnerability https://www.theverge.com/2023/11/22/23972220/microsoft-windo...

eimrine 3y ago

> The other problem with Linux is that SDCP needs to be implemented in tandem with TPM support. Another area where Linux Distros are at least 10 years behind Windows. Let me disagree, I think this is a problem of capitalism, not Linux. TPM is a closed-source technology, defective by design.