Lenovo Thinkpads have (optionally) Authentec sensors. The way it works is that the fingerprints are stored in the sensor itself. Also stored is a password (or

Lenovo Thinkpads have (optionally) Authentec sensors. The way it works is that the fingerprints are stored in the sensor itself. Also stored is a password (or equivalent). Swiping the appropriate finger then makes the password available. Consequently you can either provide the password or the fingerprint. It really is just a shortcut to providing the password. (Note that all other sensor manufacturers are effectively just a cheap scanner - the image processing and "authentication" are all done in the host software.) On the most recent Thinkpads you can swipe your finger to power on the device, get past the password protected BIOS, unlock ATA password locked drives, boot and login to Windows. (Or you can enter your password 3 times.) The sensor requires a swipe unlike large form sensors where you effectively leave your fingerprint behind. This is definitely an improvement. Fingerprint data can also be loaded for use outside of the boot process, such as an "Enterprise" where you want to manage multiple systems and allow centrally managed logins. Authentec also makes client software that keeps your passwords (think ones stored by the browser) in a vault with access controlled by fingerprint or master password. In this whole scenario fingerprints can be revoked by deleting them from the sensor or management software. However you only have ten prints before you run out. You can be observed unknowingly so passwords can also be compromised just like with latent fingerprints. It is up to someone to decide if the security tradeoffs of the Authentec scanner are acceptable. For the record I do use it on my laptop. But I'm actually a Linux user so I can only it for BIOS power on and ATA drive unlock, but not Linux authentication. Authentec do not document their protocols or provide evidence of their security. Small subsets have been reverse engineered (see libfprint).