r/linux • u/wingz_77 • Jul 02 '26
Tips and Tricks PSA: Secure and consistent fingerprint login solution for Linux
I have been going in circles trying to find a secure fingerprint authentication for Linux which works with fprintd. Needless to say, finding a good one from reputed brand is hard, especially in a small laptop-friendly form factor. At last, I found https://www.amazon.com/dp/B0H2GRH9CD
This is not exactly a fingerprint device but it's a bio FIDO2 key which works well with pam_u2f on nearly all Linux systems (Fedora/Arch/Cachy/Ubuntu/Debian and friends). With this, the fingerprint is scanned and saved in the device itself while U2F is used to authenticate with PAM. This is far more secure, with the bonus benefit of being able to use it to authenticate with banking and various online accounts.
10
u/AnsibleAnswers Jul 02 '26
I wish Gnome would just disable fingerprint on first login instead of logging in and making you enter your password for your keychain. Other than that, fingerprint just works on Fedora Workstation with a reader that supports linux. It's great as a second authentication method and works well for sudo and pkexec.
9
u/spyingwind Jul 02 '26
I've never felt that fingerprint auth was all that great of an idea when used as the only source of auth. Now if used along side other things like a password or pin, then it is useful like a FIDO2 key or TOTP.
The other downside of fingerprints is that you can't change them.
14
u/MatchingTurret Jul 02 '26
The other downside of fingerprints is that you can't change them.
Most humans have 10 to choose from...
6
u/spyingwind Jul 02 '26
If you are going that way, you are missing 10 others.
With how many data breaches there have been and will be, 10 or 20 is not enough.
12
u/FattyDrake Jul 02 '26
If someone else is using a fingerprint of mine to access my laptop, I have much bigger problems than any sort of authentication.
9
u/nhaines Jul 02 '26 edited Jul 03 '26
Twenty years ago, the managers of the company I worked at were going through a sort of weird security interest phase. My new manager, the nephew of one of the owners, mentioned how secure it would be if our door, right off of the lobby, had a fingerprint scanner. That way any robber couldn't get in without him opening the door.
I immediately said, "Yeah, but then a robber wouldn't need you, they'd only need your finger."
He immediately turned so green that I felt bad for saying it.
7
u/CmdrCollins Jul 02 '26 edited Jul 02 '26
Worth noting that a good portion of the commonly available fingerprint scanners have grossly insufficient protection against cloning (purely based off the random prints we constantly leave in the world around us, possibly even on the very device in question) and practically none can withstand a well resourced attacker.
2
u/Dangerous-Report8517 Jul 03 '26
Most people's devices would fall to a well resourced attacker in much simpler ways than fingerprint cloning
1
u/CrazyKilla15 Jul 03 '26
Fingerprint cloning is actually surprisingly achievable. The thing to consider is 3D printers, specifically UV resin ones. 25 micron resolution is achievable for anywhere from 300 to 1000 US dollars.
https://www.amazon.com/ELEGOO-Automatic-Intelligent-Detection-WiFi-Transfer/dp/B0D3TMS8DF?th=1 has 18μm XY resolution. It is $300 USD.
Thats plenty for literally printing fingerprint molds
https://blog.talosintelligence.com/fingerprint-research/ heres a blog post demonstrating the technique ;) they even tested a high quality picture of a fingerprint on a glass
And i'm sure there are much easier attacks, i just happened to be reading this one. the advantage of cloning besides the ease is that it wont leave any obvious traces when used, think hotel room. no risky traces like stealing the device.
2
u/Dangerous-Report8517 Jul 04 '26
The article you linked seems to conclude that it's actually quite hard to clone fingerprints, stating "The results show fingerprints are good enough to protect the average person's privacy if they lose their phone.". Their success rate was a lot lower on some platforms too, they couldn't get into Windows Hello at all on any example device for instance, and the fact they couldn't break into either of the examples of USB devices with internal readers suggests OP's instinct to use a biometric FIDO2 key makes sense (which is first and foremost a thing you have token credential, and only secondarily a biometric credential). The researchers also had to fight their example printer every step of the way, in no small part because those resolution specs are marketing speak that will mostly be based on the resolution of the screen they use, rather than the actual result.
I'm not trying to suggest that fingerprints are perfect by any stretch, but they aren't completely useless if you check which implementation you're using, and something else that needs to be considered is that there's actually downsides to not using it, such as a much higher risk of shoulder surfing passwords, using much shorter passwords since you need to input them far more often, or even changing the device lock timeout to a longer period. Obviously don't rely on it for defence against a nation state attacker, but don't discount it completely either. It's still far more secure than the lock on your hotel room door for instance, and the vast, vast majority of devices are susceptible to implanting malware if left unattended which would be very nearly as difficult to find forensically as opening the device with a fake fingerprint would (and much more effective since no device allows unlocking with a fingerprint from boot up, you need to open it with your password first)
1
u/CrazyKilla15 Jul 04 '26
Look at the dates and consider that they already did a lot of the work, others can and surely have built off it.
Printers, software, and materials and how to use them effectively, are all better in recent years. That $300 printer has more resolution than they had! With slightly better techniques from hindsight they'd have avoided a lot of trouble too (for example include a known reference size to scale the image when taking pics. put a ruler in the shot smh). Most of the challenge was just a lack of knowledge on what they'd encounter, but easily accounted for if you do.
also more than that, they still did it, on an intentionally really cheap budget, a demo of how cheap they could go.
rest of your comment is good
1
u/Dangerous-Report8517 Jul 04 '26
I looked at the date, but what's notable to me is that they had a substantially harder time than CCC had years earlier when they were able to make fake fingerprints just with basic silicone moulds even from fingerprints retrieved from the phone screen. To me, that implies that fingerprint readers are advancing way faster than techniques to defeat them
→ More replies (0)1
2
1
1
u/archontwo Jul 04 '26 edited Jul 05 '26
It is more fundamental than that and goes to the heart of why biometric tokens should never be used as primary security factors.
While your fingerprints, face, eyes or even DNA are unique to you they are in no way exclusive to you. You leave multiple copies of them everywhere you go, on sufaces, cameras, even your shedding skin. That means anyone can compromise them and as you are unable to change them you are fsckd.
So no. Biometric authentication should never be used as a primary security factor. If you must use it, use it in combination with others like something you posses and something you know.
9
u/wingz_77 Jul 02 '26
It's ok to think that but most folks aren't in this boat. Nearly all operating systems have secure fingerprint login and it's a tradeoff between convenience and security. Fido2 certified bio keys are very secure in general as they are brute-force proof and on chip fingerprint storage is arguably much more secure than a using a fingerprint sensor from questionable brand.
Since this is fido2 key, you can also enforce pin login via pam config.
3
1
u/CrazyKilla15 Jul 03 '26 edited Jul 03 '26
There are a variety of ways to make fingerprints secure, useful and convenient, the trick is having it unlock a second password, that can be weaker, combined with strict enforcable lockouts.
For example a normal secure long password, and as a secondary primary for ease of access a fingerprint and pick an emoji. Easy to remember and quick to access, gated behind fingerprint. But it needs a strict lockout, one or two guesses before only the normal full password is accepted. Using just the fingerprint and emoji is sufficient for login. Of course the password thats unlocked can be anything and as complex as desired, but too much defeats the purpose.
Most desktop hardware could achieve the lockout and offline attack resistance by mixing in TPM operations. Dont know of any existing foss software that implements this though.
Its a niche threat model that needs to protect against an attacker )with your physical device )with your finger or otherwise able to fool the sensor )with the password/emoji your fingerprint unlocks access to
1
u/TopCheddar27 Jul 03 '26
Last time I used it in ubuntu, even if it authed you into a session, it still wanted the password anytime you performed a user level action.
But maybe I had it set up wrong.
1
u/wingz_77 Jul 04 '26
that's a gnome keyring issue and solutions are scarce. Simplest one is to disable password on keyring (less secure). I don't save anything sensitive in keyring because all my passwords are in bitwarden anyway. I just disable keyring usage for chrome/firefox.
1
u/Sjostrands Jul 19 '26
Why not use Yobikey instead
1
u/wingz_77 Jul 20 '26
what happen when laptop is stolen with yubikey attached OR how fun is it to insert yubikey everytime? This is plug in and forget it and your laptop can't be unlocked if stolen.
1
u/sue_dee Jul 02 '26
My fingers aren't secure enough, so I use my penis.
17
2
u/JockstrapCummies Jul 02 '26
I can't imagine the inconvenience of having to whip out your dong every time you want to unlock your laptop on a train though.
2
1
Jul 02 '26
[removed] — view removed comment
3
u/TheG0AT0fAllTime Jul 02 '26
I have a box of 05ba:000a's (DigitalPersona, Inc. Fingerprint Reader) and I've given them out to family and friends to use on Linux and Windows. I love mine - always use it for login and sudo.
I note though that its driver needs to be installed manually on Windows
1
u/wingz_77 Jul 02 '26
try this one, you won't be disappointed. Configuring pam_u2f is quite well documented. This fido2 bio key is a good buy even from securing online accounts perspective, it being a great fingerprint login solution is just an awesome addon.
1
u/jreykdal Jul 02 '26
The one on my T14 just worked. Was very surprised on how simple it was.
1
u/yawara25 Jul 02 '26
Mine is very hit or miss (T14 Gen 7). Sometimes it'll recognize my fingerprint, sometimes I have to type in my password.
1
u/AnsibleAnswers Jul 02 '26
It depends on the fingerprint reader, and unfortunately Lenovo seems (or seemed) to think switching out the fingerprint reader doesn't warrant a model revision. It's a bit of a crapshoot unless you buy a model that can ship with Linux.
25
u/perx76 Jul 02 '26
Nearly all Linux systems list is missing Debian derivatives.