- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
You must log in or register to comment.
Fingerprint sensors have been an interesting hurdle for Linux distros. Not one I necessarily would have anticipated either. The biggest question seems to come down to their security as well, given that there have been exposed flaws in the design of biometric hardware that tries to generalize its compatibility.
Microsoft has defined SDCP as a strong standard for TPM/Windows, but there isn’t an equivalent for Linux. Match on chip sensors have made things a bit easier, but there isn’t a standard way to communicate the validated authentication to the OS, usually relying on TLS.
it’s always amazed me that fingerprint sensors aren’t all match on chip, for the longest time I assumed that the fingerprint reader held a key for unlocking the device that is only returned with the correct fingerprint. How else do you implement them securely?
It is. It’s just… how do you know you’re actually talking to the fingerprint sensor and not a fake one that’s been plugged in?
Think of it like a locked mailbox: the fingerprint sensor might securely match the fingerprint and only unlock if it’s correct—but if anyone can swap out the mailbox with their own lookalike, and the OS just blindly accepts the “unlocked” signal, the whole security model breaks. Without an attestation mechanism (like SDCP on Windows or secure enclave-backed verification), the OS can’t prove it’s getting input from trusted hardware. Match-on-chip helps, but it’s not enough unless the result is cryptographically signed by the sensor and validated by the OS through a trusted, authenticated channel.
That’s the gap in Linux: there’s no widely adopted standard for verifying that trust path end-to-end.
This only really works for people who have hardware whose fingerprint readers are supported by upstream fprintd; would be interesting if they (or another distro; haven’t seen anybody implement this yet) add a “just works” option for installing and setting up e.g.
libfprint-tod-vfs0090orpython-validity(which I use on two of my machines actually), similar to how some distros (Mint included I believe, but haven’t dealt with it in a while) give you an option for installing Nvidia proprietary drivers (or just make it work out of the box).However these drivers are extremely sketch at times so… I guess there’s some good out of it not being preconfigured for people (because you have to look into it yourself and realize just how terrifying they are, both security and stability wise,
python-validityespecially)…(though now I’m on NixOS where I have it pretty much “just work” through not that much effort, at least not as much as on Arch, and definitely not as much as on Mint which was painful because PPA fuckery)
ah, there is it. My reader isn’t supported by fprintd so I guess I wouldn’t benefit from this change. I’m glad I saw this before I decided to give mint another go
deleted by creator
