Adding Biometric Security to an Existing Laptop? 46
008 asks: "My work requires me to travel to some harsh climes with my laptop and other equipment, and the data I collect there is potentially very sensitive. Currently I use the PGP family to secure my drives, but my paranoia always demands more. IBM's biometric-ready Thinkpad really piques my interest, but getting one isn't feasible for me because it's too wimpy for the physical stress I'd inflict on it. I'd much prefer a way to biometrically lock a computer I already have. What options are out there?"
TrueCrypt (Score:2)
Not biometric, but a good way to keep information safe.
Re:TrueCrypt (Score:2)
it gives a logon prompt before windows boots, and supports single-sign on, too, so it can log you into your domain as well.
I'm scared of proprietary encryption. (Score:2)
TrueCrypt seems quite fast.
Re:I'm scared of proprietary encryption. (Score:3, Informative)
How do you know...? (Score:2)
From the link you cited: "However, due to the possibility of changes made within individual companies, NIST cannot guarantee that this document reflects the current status of each product. It is the responsibility of the vendor to notify NIST of any necessary changes to its entry in the following list."
Why accept this weasel-worded statement when you can have open source TrueCrypt?
Re:How do you know...? (Score:3, Informative)
A few places (Score:2, Informative)
Thinkpads aren't that delicate. (Score:1)
Re:Thinkpads aren't that delicate. (Score:1)
With all due respect, there's a reason they make Toughbooks/Extreme-Condition-Notebooks differently than IBM makes Thinkpads. Stuff like sealing off the electronics from the elements.
Although, I heard back in the day that IBM laptops use to be designed to withstand a 6 foot drop.
Quite impressive.
Re:Thinkpads aren't that delicate. (Score:1)
Re:Thinkpads aren't that delicate. (Score:1)
Thus, implying as tough as the notebook mentioned by the previous poster.
Throw a blanket over it (the laptop) (Score:2, Funny)
Biometrics Not Security Device (Score:2, Insightful)
~UP
Biometric scanners are a sales gimmick. (Score:4, Informative)
Re: (Score:2)
Re:Biometric scanners are a sales gimmick. (Score:3, Insightful)
Re:Biometric scanners are a sales gimmick. (Score:1)
Re: (Score:2)
Re:Biometric scanners are a sales gimmick. (Score:1)
Re:Biometric scanners are a sales gimmick. (Score:3, Interesting)
Re:Biometric scanners are a sales gimmick. (Score:2)
Keys and hashes are only safe as long as they do not exist on the hardware you want to hack. If there's a copy in your hardware, its comprimisable.
Re:Biometric scanners are a sales gimmick. (Score:2)
The difference is that in the case of a biometric scan, the decryption key to your data is stored as plaintext on your computer, if they even bother to encrypt the data at all. So if I can steal your comput
Re:Biometric scanners are a sales gimmick. (Score:3, Interesting)
All the scanner can say is "yes, that looks like the right fingerprint," or "no, that doesn't look like the right fingerprint."
Actually, it's even worse than that. The scanner typically doesn't do anything like that. All it does is deliver a grayscale digital image (called the "livescan") over USB or whatever to your laptop. Software running on your laptop then must extract the interesting features, producing a livescan template, which it then compares against the stored template. The template compar
Re:Biometric scanners are a sales gimmick. (Score:2)
I own a T42 and I must say, it's quite handy to have. You can set the fingerprint scan in one of three ways (or a combination):
1 - on boot
2 - Windows login, locally attached to your profile
3 - Windows login, profile fed from a server
Naturally, the encryption only works with method #1, but it will protect from having the drive moved to a different machine. What I haven't figured out is what happens
Don't bother (Score:5, Informative)
From a security perspective, it's probably not worth the effort. The circumstances in which a biometric authentication actually adds to your security are surprisingly restricted. Mostly, biometrics increase security by providing a convenient but weak authentication tool for situations in which the alternative is no authentication at all. The old saw about "something you know, something you have and something you are" presumes that the attacker actually has to "be" the "something you are" and can't simply bypass the authentication. That's hard to achieve in the real world.
No, if you want to protect sensitive data on your computer, the main thing you need to do is to encrypt it, and then store the keys somewhere an attacker can't get them. If the keys are stored on the computer, then an attacker can probably get them. Keys stored in your head are safe, and keys stored in an external device which stays with you, not with the laptop, are also safe. Best is to use both.
The best you can do presently, IMO, is to:
In practice, 2 and 3 are pretty easy to do, and the result is fairly decent security. 1 is very good, but as I said it's not really easy to implement. 4 is critical and pretty hard to be certain you've done unless you simply disable network, USB etc. devices.
If you have a laptop with a Trusted Computing TPM in it, there are some other options that may theoretically provide assurance levels that are almost as good as a smart card, but I'm not sure if the tools exist to make using those options practical, much less easy. I've been fiddling with using the TPM in my Thinkpad to bind the keys used for a dm_crypt encrypted file system.
Re:Don't bother (Score:2)
Re:Don't bother (Score:4, Informative)
In practice, all 3 reduce to the same thing- something you know. Need a smart card to log in? The smart card just knows a really long key. If you know the key on the card, making a forgery is trivial.
Not really true.
While it certainly is true that the smart card just knows a key, the value such a token provides lies in the fact that the key never leaves the card, so no one can know it. Particularly for PKI-based authentication technologies, most smart cards can generate the key pair on the card so that the private key never, ever leaves the card. The card can be configured to refuse to ever divulge that key, no matter how you authenticate yourself to it. Even for symmetric key-based authentication, as long as key injection and auth validation are both done in secure environments, it's reasonable to consider the key completely tied to the token.
Of course, that assumes there's no way to bypass the authentication requirement.
Biometrics are a particularly weak secret.
Absolutely. That's why I say they're really only useful in circumstances where the alternative is no authentication at all. Well, they're also useful in extremely high security scenarios, where precautions can be taken to thwart all of the typical attacks. Those scenarios typically involve an armed guard scrutinizing the person who is authenticating themselves, authentication and matching systems that are under tight physical security, etc. The bottom line is that biometrics are much less useful than people naively think.
Re:Don't bother (Score:2)
Doesn't matter if it doesn't leave the card- it can still be read from the card. In the end, the card is emitting a particular digital signal to a reader (the computer). Tha
Re:Don't bother (Score:2)
The deal is that it should be more expensive to get the secret out than to
Re:Don't bother (Score:2)
Doesn't matter if it doesn't leave the card- it can still be read from the card. In the end, the card is emitting a particular digital signal to a reader (the computer). That signal can be duplicated.
Doesn't matter if you can replay the "signal" (which is actually a sequence of bits over a 9600 baud serial line) because the value is only good once. Cryptography is very good at solving some problems, and securely authenticating without revealing the key is one of them.
The smart card can always be read
Re:Don't bother (Score:3, Informative)
One place I have seen it and liked it is lockers at amusement parks.
That's a terrible place to use biometrics. The false reject rate has to be very low or the customers will complain, which means that the false accept rate will be high. Combine that with the typically poor resolution of fingerprint matchers, throw in the effect of the Birthday Problem, and I guarantee that if you get a significant number of people who try to get into multiple lockers, you'll have some of them get into lockers that aren
how? or why would you? (Score:3, Interesting)
but making it into a good use in the system, now that's a whole another issue. would you use the biometric data as a password for that pgp drive or what?
Biometrics have an inevitable risk (Score:2)
For example, your thumbprint can be lifted from a water glass.
And your retinal scan can be lifted any time you go to the eye doctor.
Or even worse... (Score:2)
Re:Or even worse... (Score:1)
BBC? Reputable? (Score:3, Interesting)
Darn, why... (Score:2)
No, if
Biometric PC-Card (Score:3, Informative)
http://www.identix.com/products/pro_info_fp_bioto
Others:
http://www.secure-it.com/products/umatch/via253.h
http://www.thinkgeek.com/gadgets/security/6518/ [thinkgeek.com]
That would seem to be what you're looking for for a laptop. The Biometric sensor slides in and out of the card leaving it perfectly flush with the side of the laptop. This should help avoid accidental breakage.
My experience comes mostly from the Identix Optical sensors. Problems:
-Optical Biometrics can be bypassed via simple gummibear technology
-Optical sensors are notoriously finicky. People with poor fingerprint definition - people who work with their hands, as in a garden (earth is abrasive) or workout with weights (sometimes the weight bars can be abrasive) might have problems getting their fingerprints read. Same goes for dry skin, and for some reason, black people. Not trying to be racist here or anything, we did a pilot at work a few years back and 9/10 black people had problems getting their prints read by the system.
-Anything that messes with your Windows GINA authentication system can cause problems. I've seen the Identix product freak out if it couldn't find an internet connection, or a domain controller, or the internet connection was half baked, etc. It was very very random. May have been solved with their latest service packs.
Finally, you're still best off applying some form of encryption to your files.
Good luck,
-Jack Ash
MPC, or something like that (Score:1)
Through MPC, our company managed to obtain a few small-business products, including ruggedized laptops. If you give their sales people a call
IBM has an external device (Score:1, Informative)
I'd get one of these instead (Score:1)
Use a TPM trusted platform module (Score:1)