> it's that fprintd is horribly outdated with current tech

This current tech? https://www.theregister.com/2023/11/22/windows_hello_fingerp...

If an attacker has physical access long enough to connect a MITM on your fingerprint reader, it's not your laptop anymore.

This line of thinking can and is used as an excuse for all sorts of security shortcomings. Yes, in threat modelling, this would be give fairly limited opportunity as an attack vector, but any successful attack could have a massive impact. It makes sense for device owners to consider this possibility in how they protect their machines, and for device manufacturers to attempt to mitigate it.

No, this line of thinking is basic threat modelling and stops us wasting time and effort on navel gazing when it would be better spent on things we can control. An invasive, non-destructive physical attacker also has access to (likely unencrypted) drives, memory buses, HIDs, audiovisual inputs...

'Fixing' this doesn't make your machine any less pwned if you let them touch it.

The linked article says it's not a problem with all implementations. This would suggest device manufacturers can defend against it, but some have chosen not to. Given the choice of a laptop where this risk is mitigated and one where it isn't, all other things being equal, I'd choose the one with protections in place.

Ok, but none of modern computing was designed around this mentality. Virtually all computers are trivially compromisable if you have physical access to the machine.

This doesn't appear as true for the latest Apple Silicon macs. They are quite locked down by default

That is not what this attack does. You steal the laptop and then do a trick to unlock the secrets without giving back the laptop. Your MITM is fooling the fingerprint reader and the OS, not the user.

The point of the system is to protect against an attacker who steals the laptop so it is a complete failure.

SCDP describes a driver-level API, it doesn't tell you how to talk to the actual hardware. Vendors ship Windows drivers that implement that API but I'm not aware of any who've documented it. And while SCDP provides a secure communication channel with the biometric device, in itself that doesn't give you an ability to seal secrets to that device based on the biometric data.

My 2 year old laptop's fingerprint reader still doesn't work in Linux: Its native resolution is too high for the driver to handle, and somehow that's been an unfixable problem for years now.

> Another area where Linux Distros are at least 10 years behind Windows.

I don't really understand the way that people who apparently should know better still frame the issue as a "Linux" problem, instead of a "hardware vendors" problem.

When vendors cooperate, open-source is on par with other OSs (see AMD and Intel), but when they don't then it's amazing that things are working to the level that they do, and I am thankful.

I don't get the distinction. Linux has to run on the hardware, no?

Linux doesn't "have" to run on the hardware. The vendors put in all the work to make the hardware work for Windows (not Microsoft); the Linux community often has to do all the work themselves (usually starting by reverse engineering hardware, due to uncooperative vendors).

Linux does have to run on the hardware if it wants to be used by people. Blaming vendors doesn't fix the problem or get the community anywhere. This just reeks of being blinded by pride.

> Blaming vendors doesn't fix the problem or get the community anywhere.

Neither does blaming Linux developers.

But the fact is, Linux developers are doing their best to cooperate, while hardware vendors aren't. It's not about assigning blame, it's about describing the objective state of facts.

Saying that Linux is behind windows in some particular functionality isn't blaming developers.

Saying "Linux is lacking some particular functionality that Windows has" in isolation isn't blaming developers.

Saying "[this is yet] another area where Linux Distros are at least 10 years behind Windows" has a certain unpleasant tone that reeks of blame.

“10 years behind Windows” haha pardon me I almost choked from laughing to hard.

> Saying "[this is yet] another area where Linux Distros are at least 10 years behind Windows" has a certain unpleasant tone that reeks of blame.

How do you figure? This just strikes me as insecurity. Regardless of the fact that your quote represents a nonsensical claim, Linux's lack of hardware support isn't something worth dancing around, it's just reality.

> How do you figure? This just strikes me as insecurity.

You could say that about any kind of criticism related to someone's tone, and nobody could prove you wrong. I'm just sharing my own opinion about the quote.

But considering the other comments on this thread, it's fair to say that my opinion is shared by many other people here - so either we're all insecure, or my quote really has a certain unpleasant tone that reeks of blame.

Nobody was blaming Linux developers. This doesn't change the fact that Linux doesn't support vast swathes of hardware.

Nobody was blaming vendors either. That doesn't change the fact that vast swathes of hardware vendors put much more effort into helping Windows support their hardware than Linux.

I am not sure why you think "Linux" wants to be used by people. There is no "Linux" in that sense.

The people that want to run Linux on their machines, make efforts in that direction, either by ensuring that the hardware they run Linux on is compatible, or invest time/money in making it compatible. When hardware vendors provide documentation and man power it's "easy", when they don't it's hard or impossible or, like in this specific case, only the basic capabilities of the hardware can be exploited.

Have you ever reversed a driver and implemented it yourself with no help of any documentation or data sheets?

This hasn't been implemented because none of the people who value Linux and have the technical skills to implement this care about fingerprint readers, nor care to support people who do. If you don't like that, then do it yourself or pay somebody else to do it for you.

Your comment is saying something that everybody already knows. It doesn’t add to the conversation, it’s needless snark.

NoLsAfterMid's comment betrays an entitled attitude (e.g. "Linux should want this because I want this"), he doesn't seem to actually understand how or why things get done in the area of Linux. Linux itself doesn't "want" things, Linux itself cannot want to support particular use cases. Either somebody who wants something supported does it themself, or they pay somebody else to do it.

It depends on your frame of reference. To the end user or in a conversation about "can I install Linux on the family PC", maybe there is no distinction. To people posting on what is a tech forum considering the root of the issue, there is. This is the latter.

It's simply because hardware vendors don't have a big problem with the state of hardware, but Linux users do.

Do you know any workarounds to make Windows not ask me to login on a Ms account whenever I try to setup the fingerprints?

Using my Fedora installation on a XPS Plus was plug and play, no login needed.

I have a Samsung Book with Windows 11 that I can't do the same. :(

I have an Acer laptop with fingerprints and without a MS account.

I entered the wrong password to a fake MSFT account and that let me create a local account.

Setting up fingerprint scanning was part of the OOBE.

If this isn’t possible for you, try downgrading to Win10, setting it up, and upgrading.

Absurd that anyone would be ok with this kind of treatment from their OS vendor.

Take a look at how secure Microsoft’s solution really is:

https://www.theverge.com/2023/11/22/23972220/microsoft-windo...

> The other problem with Linux is that SDCP needs to be implemented in tandem with TPM support. Another area where Linux Distros are at least 10 years behind Windows.

Let me disagree, I think this is a problem of capitalism, not Linux. TPM is a closed-source technology, defective by design.

> Another area where Linux Distros are at least 10 years behind Windows.

I don't think that my computer requires a fingerprint sensor to function.