Laptop fingerprint reader destroys 'entire security model of Windows accounts'

Re:Laptop fingerprint reader destroys 'entire security model... by rlu on Thursday September 06, 2012 @10:27PM (#4487414)

I don't have one of these compuetrs so I don't know how it works but by reading the article it seems to me like you need to supply a password to the software which is then stored in almost plain text. The assumption the article is making is that people will enter their Windows account password?

Correct me if I'm wrong.

[ Parent | on HN ]

Re:Laptop fingerprint reader destroys 'entire security model... by ljf on Friday September 07, 2012 @02:22AM (#4487867)

You have to supply your windows password to the software. When you swipe your finger the software then supplies your password to the computer and logs you in without you having to type it.

[ Parent | on HN ]

Re:Laptop fingerprint reader destroys 'entire security model... by ithkuil on Friday September 07, 2012 @09:47AM (#4488978)

why is actually this necessary? In linux, you could create a PAM module that proofs your identity somehow and then says "ok" to the login subsystem.

There is no need to know your password in order to log you in, if the security subsystem is well designed.

On the other hand, if your home volume is encrypted, the system has to get the right key somehow; so the key itself should be stored in a way that's accessible to the fingerprint auth software (i.e. in clear).

Usually the encryption key is based on the user password but it doesn't have to be the cleartext password. So, using biometrics only, the home volume encryption is weakened, but the password isn't necessarily revealed, and that's an important distinction given that most of the people use the same (or few) password(s) everywhere.

[ Parent | on HN ]

Re:Laptop fingerprint reader destroys 'entire security model... by maxerickson on Friday September 07, 2012 @09:53AM (#4489002)

I'm no expert, but it probably isn't necessary:

http://msdn.microsoft.com/en-us/magazine/cc163803.aspx

So it's more that it is a poor implementation.

[ Parent | on HN ]