Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security

Adding Biometric Security to an Existing Laptop? 46

Posted by Cliff from the usb-retinal-scanner-anyone dept.
008 asks: "My work requires me to travel to some harsh climes with my laptop and other equipment, and the data I collect there is potentially very sensitive. Currently I use the PGP family to secure my drives, but my paranoia always demands more. IBM's biometric-ready Thinkpad really piques my interest, but getting one isn't feasible for me because it's too wimpy for the physical stress I'd inflict on it. I'd much prefer a way to biometrically lock a computer I already have. What options are out there?"
This discussion has been archived. No new comments can be posted.

Adding Biometric Security to an Existing Laptop? More

Adding Biometric Security to an Existing Laptop?

Comments Filter:
  • People say good things about TrueCrypt [truecrypt.org]. I've just begun using it.

    Not biometric, but a good way to keep information safe.
    • try http://www.pointsec.com/ [pointsec.com]. it's not biometrics, it's a username/password, but it encrypts the whole drive in 256 DES. works great, we have it on thousands of machines at work. it'll slow down a borderline-spec laptop though.
      it gives a logon prompt before windows boots, and supports single-sign on, too, so it can log you into your domain as well.
      • I'm scared of proprietary encryption. It is very difficult to implement encryption well. Proprietary software asks you to believe claims made by marketing people who probably don't understand any of the issues.

        TrueCrypt seems quite fast.
        • Perhaps you are unaware that NIST certifies [nist.gov] encryption libraries so you don't have to believe marketing people. I would not use a product that can't show NIST certs.
          • How do you know if they are using the library unmodified? How do you know if they are using the library correctly?

            From the link you cited: "However, due to the possibility of changes made within individual companies, NIST cannot guarantee that this document reflects the current status of each product. It is the responsibility of the vendor to notify NIST of any necessary changes to its entry in the following list."

            Why accept this weasel-worded statement when you can have open source TrueCrypt?

            • Re:How do you know...? (Score:3, Informative)

              by RMH101 ( 636144 )
              it's all about enterprise readiness. i don't have any personal experience of truecrypt, but I do of pointsec, and i'd trust pointsec enterprise-wide. it does decent recovery by authorised users, it can be installed silently when pushed out via SMS or login scripts, and it encrypts in the background. it just kind of works. truecrypt may be just as good, but as i say, i don't have confidence through experience with it yet.

  • A few places (Score:2, Informative)

    by Hikaru79 ( 832891 )
    I'm pretty sure Targus [targus.com] and Digital Persona [digitalpersona.com] both produce the kind of addon you're looking for. Also, there's a biometric flash key [ecost.com] available. Hope this helps :)
  • I've trucked a thinkpad through campus for 5 years now, dropping, abusing, subjecting it to 110dB concerts, etc and it takes it very well. Some damage, but i haven't broken anything major. I've currently got one of the biometric machines.
  • Security through obscurity.
  • As any IBM, Microsoft (hardware), or APC rep could tell you, Biometric devices are not security devices. If you want more security, look somewhere else.

    ~UP

  • Biometric scanners are a sales gimmick. (Score:4, Informative)

    by mellon ( 7048 ) * on Wednesday October 05, 2005 @09:59PM (#13726846) Homepage
    You can't use them to protect your hard drive. All it takes to get the data off is for someone to pull the hard drive out and put it in a different system. You are better off sticking with PGP, which actually encrypts the data.
    • Comment removed based on user account deletion
    • Well, I would assume that such systems would use the biometric factor as the key with which it encrypts the data. But I could be wrong...
      • Tragically, you are mistaken in this case. Biometric data is analog. All the scanner can say is "yes, that looks like the right fingerprint," or "no, that doesn't look like the right fingerprint." It can't produce a consistent digital value that is derived from the fingerprint. It is possible to make a fingerprint scanner that's self-contained and emits a key whenever it gets a match, but that's probably not what IBM is doing, because that would require putting a fairly expensive CPU in the fingerpr
        • It would also make it easy to hack. The fingerprint scanner would need the key, either in ROM or flash memory. Grab the code the scanner runs, decompile and find where it accesses the data from. You can now get the key from any of their scanners.

          Keys and hashes are only safe as long as they do not exist on the hardware you want to hack. If there's a copy in your hardware, its comprimisable.
          • Just to be clear here, if you type in the key, that's even easier to hack than the biometric scan, if only because the amount of data is smaller. If someone has physical access to your machine while you're authenticating, you're screwed whether you're using a biometric scan or a memorized access code.

            The difference is that in the case of a biometric scan, the decryption key to your data is stored as plaintext on your computer, if they even bother to encrypt the data at all. So if I can steal your comput

        • All the scanner can say is "yes, that looks like the right fingerprint," or "no, that doesn't look like the right fingerprint."

          Actually, it's even worse than that. The scanner typically doesn't do anything like that. All it does is deliver a grayscale digital image (called the "livescan") over USB or whatever to your laptop. Software running on your laptop then must extract the interesting features, producing a livescan template, which it then compares against the stored template. The template compar

    • Actually, IBM has partnered with another firm and software is available that'll encrypt every byte on the drive.

      I own a T42 and I must say, it's quite handy to have. You can set the fingerprint scan in one of three ways (or a combination):

      1 - on boot

      2 - Windows login, locally attached to your profile

      3 - Windows login, profile fed from a server

      Naturally, the encryption only works with method #1, but it will protect from having the drive moved to a different machine. What I haven't figured out is what happens

  • Don't bother (Score:5, Informative)

    by swillden ( 191260 ) <shawn-ds@willden.org> on Wednesday October 05, 2005 @10:20PM (#13726933) Journal

    From a security perspective, it's probably not worth the effort. The circumstances in which a biometric authentication actually adds to your security are surprisingly restricted. Mostly, biometrics increase security by providing a convenient but weak authentication tool for situations in which the alternative is no authentication at all. The old saw about "something you know, something you have and something you are" presumes that the attacker actually has to "be" the "something you are" and can't simply bypass the authentication. That's hard to achieve in the real world.

    No, if you want to protect sensitive data on your computer, the main thing you need to do is to encrypt it, and then store the keys somewhere an attacker can't get them. If the keys are stored on the computer, then an attacker can probably get them. Keys stored in your head are safe, and keys stored in an external device which stays with you, not with the laptop, are also safe. Best is to use both.

    The best you can do presently, IMO, is to:

    1. Use an encrypting file system that allows you to store the keys on an external security token -- a smart card. Note that Microsoft Windows provides smart card support and encrypted file system support, but you can't encrypt your files with keys on the card. That's supposed to be fixed in Vista. At present, Linux and the *BSDs are the only way I know of to fully achieve this, and it's non-trivial.
    2. Use a boot password, and power your machine off whenever you're going to be separated from it. On most laptops today, the boot password is actually implemented by the hard drive firmware. Without the correct boot password, the drive will refuse to operate. To work around it, the attacker would actually have to replace the PCB on the hard drive -- a non-trivial operation. This is surprisingly good security. Getting it requires that you shut down your machine, though, not just suspend it.
    3. For the times when you don't shut your machine down, use a smart card for login, disable password-based login (so the OS *requires* the card) and make sure that your screen saver will come on and lock whenever the card is removed -- requiring the card and PIN to unlock it. This ensures that an attacker will (probably) have to shut the machine down before he can try to get at the data, and he'll run right into your boot password. Oh, and never leave the smart card with the machine.
    4. Finally, make sure that your machine isn't wide open to network-based attacks which would allow an attacker to trivially bypass all of the rest. Also, be very careful where you get software from to avoid trojans. Make sure USB devices and other peripherals don't get to run software upon insertion, either.

    In practice, 2 and 3 are pretty easy to do, and the result is fairly decent security. 1 is very good, but as I said it's not really easy to implement. 4 is critical and pretty hard to be certain you've done unless you simply disable network, USB etc. devices.

    If you have a laptop with a Trusted Computing TPM in it, there are some other options that may theoretically provide assurance levels that are almost as good as a smart card, but I'm not sure if the tools exist to make using those options practical, much less easy. I've been fiddling with using the TPM in my Thinkpad to bind the keys used for a dm_crypt encrypted file system.

    • "Something you know, something you have, something you are" is a bad idea to actually use. In practice, all 3 reduce to the same thing- something you know. Need a smart card to log in? The smart card just knows a really long key. If you know the key on the card, making a forgery is trivial. Something you are? At some point, that something you are has an analog or digital signal representation sent into the computer. If you know the representation, you can fake it. Everything in security boils down t

      • Re:Don't bother (Score:4, Informative)

        by swillden ( 191260 ) <shawn-ds@willden.org> on Thursday October 06, 2005 @04:02PM (#13733580) Journal

        In practice, all 3 reduce to the same thing- something you know. Need a smart card to log in? The smart card just knows a really long key. If you know the key on the card, making a forgery is trivial.

        Not really true.

        While it certainly is true that the smart card just knows a key, the value such a token provides lies in the fact that the key never leaves the card, so no one can know it. Particularly for PKI-based authentication technologies, most smart cards can generate the key pair on the card so that the private key never, ever leaves the card. The card can be configured to refuse to ever divulge that key, no matter how you authenticate yourself to it. Even for symmetric key-based authentication, as long as key injection and auth validation are both done in secure environments, it's reasonable to consider the key completely tied to the token.

        Of course, that assumes there's no way to bypass the authentication requirement.

        Biometrics are a particularly weak secret.

        Absolutely. That's why I say they're really only useful in circumstances where the alternative is no authentication at all. Well, they're also useful in extremely high security scenarios, where precautions can be taken to thwart all of the typical attacks. Those scenarios typically involve an armed guard scrutinizing the person who is authenticating themselves, authentication and matching systems that are under tight physical security, etc. The bottom line is that biometrics are much less useful than people naively think.

        • While it certainly is true that the smart card just knows a key, the value such a token provides lies in the fact that the key never leaves the card, so no one can know it. Particularly for PKI-based authentication technologies, most smart cards can generate the key pair on the card so that the private key never, ever leaves the card.

          Doesn't matter if it doesn't leave the card- it can still be read from the card. In the end, the card is emitting a particular digital signal to a reader (the computer). Tha

          • No, the card has a small on-board computer. You hand it something, it encodes it, and then you present that to another device that also knows the secret. The other device verifies that you have the thing that knows the secret, but you never find out the secret. So it's not just "a signal" - it's a mechanism. That's what makes it "secure". I say "secure" because you are right that in theory you can always get the secret out.

            The deal is that it should be more expensive to get the secret out than to

          • Doesn't matter if it doesn't leave the card- it can still be read from the card. In the end, the card is emitting a particular digital signal to a reader (the computer). That signal can be duplicated.

            Doesn't matter if you can replay the "signal" (which is actually a sequence of bits over a 9600 baud serial line) because the value is only good once. Cryptography is very good at solving some problems, and securely authenticating without revealing the key is one of them.

            The smart card can always be read

          • Re:Don't bother (Score:3, Informative)

            by swillden ( 191260 )

            One place I have seen it and liked it is lockers at amusement parks.

            That's a terrible place to use biometrics. The false reject rate has to be very low or the customers will complain, which means that the false accept rate will be high. Combine that with the typically poor resolution of fingerprint matchers, throw in the effect of the Birthday Problem, and I guarantee that if you get a significant number of people who try to get into multiple lockers, you'll have some of them get into lockers that aren

  • how? or why would you? (Score:3, Interesting)

    by gl4ss ( 559668 ) on Wednesday October 05, 2005 @10:31PM (#13726993) Homepage Journal
    how is easy, just buy a usb dongle reader.

    but making it into a good use in the system, now that's a whole another issue. would you use the biometric data as a password for that pgp drive or what?
  • Are you *sure* you want biometrics? If someone gets a hold of your data then what do you do-- change your body?

    For example, your thumbprint can be lifted from a water glass.

    And your retinal scan can be lifted any time you go to the eye doctor.

  • Biometric scanners, PGP encryption, What's next? While undoubtedly fancy, I don't think they make your data that much more secure. While it probably makes it a bit more difficult to access you data, as soon as your data is stolen, it is stolen, and unless you get it back fast, the blackhats will have all the time in the world to try to access it. And chances are, they will. Also, these security solutions are brittle. In case something bad happens, you might not be able to access your data yourself!

    No, if

  • Biometric PC-Card (Score:3, Informative)

    by JackAsh ( 80274 ) on Thursday October 06, 2005 @08:43AM (#13728976)
    Identix makes a Biometric PC-Card:

    http://www.identix.com/products/pro_info_fp_biotou ch_pc.html [identix.com]

    Others:

    http://www.secure-it.com/products/umatch/via253.ht m [secure-it.com]
    http://www.thinkgeek.com/gadgets/security/6518/ [thinkgeek.com]

    That would seem to be what you're looking for for a laptop. The Biometric sensor slides in and out of the card leaving it perfectly flush with the side of the laptop. This should help avoid accidental breakage.

    My experience comes mostly from the Identix Optical sensors. Problems:
    -Optical Biometrics can be bypassed via simple gummibear technology ;). Google it up if you don't believe it :).

    -Optical sensors are notoriously finicky. People with poor fingerprint definition - people who work with their hands, as in a garden (earth is abrasive) or workout with weights (sometimes the weight bars can be abrasive) might have problems getting their fingerprints read. Same goes for dry skin, and for some reason, black people. Not trying to be racist here or anything, we did a pilot at work a few years back and 9/10 black people had problems getting their prints read by the system.

    -Anything that messes with your Windows GINA authentication system can cause problems. I've seen the Identix product freak out if it couldn't find an internet connection, or a domain controller, or the internet connection was half baked, etc. It was very very random. May have been solved with their latest service packs.

    Finally, you're still best off applying some form of encryption to your files.

    Good luck,

    -Jack Ash
  • I know it's not ruggedized, like you want, but MPC offers a line of laptops that have biometric fingerprint scanners installed factory. The software included is quite nice, including a secure place to store files once you've logged in. I haven't locked my system down completely with the software, but it does offer a BIOS-level scan (and password if you fail the scan).

    Through MPC, our company managed to obtain a few small-business products, including ruggedized laptops. If you give their sales people a call

  • IBM has an external device (Score:1, Informative)

    by Anonymous Coward
    The IBM laptop with built-in fingerprint reader is nice, but IBM also sells a keyboard with biometric and a simple USB biometric device. You could hook one of those up to any laptop.
  • one of the best solution is to use a laptop that has a TPM like the thinkpad. This technology provides the strong key protection that is state of the art and most machines come with File and folder encryption that can use these keys. A pin or Biometric is used to release the use of the keys that are then used to decrypt or encrypt the data. The newer thinkpads have both the Sensor and the TPM.

Slashdot Top Deals

Our OS who art in CPU, UNIX be thy name. Thy programs run, thy syscalls done, In kernel as it is in user!

Close