Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.project > #12153 > unrolled thread

Debian and fingerprint readers

Back to article view | Back to linux.debian.project

Contents

  Debian and fingerprint readers Mark Pearson <markpearson@lenovo.com> - 2021-02-24 22:20 +0100
    Re: Debian and fingerprint readers Paul Wise <pabs@debian.org> - 2021-02-25 07:40 +0100
      Re: Debian and fingerprint readers Wouter Verhelst <wouter@debian.org> - 2021-03-04 16:40 +0100
        Re: Debian and fingerprint readers William Bonnet <william@wbonnet.net> - 2021-03-04 17:10 +0100
          Re: Debian and fingerprint readers Wouter Verhelst <wouter@debian.org> - 2021-03-05 09:20 +0100
    Re: Debian and fingerprint readers Sam Hartman <hartmans@debian.org> - 2021-03-05 00:20 +0100
      Re: Debian and fingerprint readers Wouter Verhelst <wouter@debian.org> - 2021-03-05 09:20 +0100
        Re: Debian and fingerprint readers Philip Hands <phil@hands.com> - 2021-03-05 12:20 +0100
          Re: Debian and fingerprint readers Pirate Praveen <praveen@onenetbeyond.org> - 2021-03-07 16:20 +0100
        Re: [External] Re: Debian and fingerprint readers Mark Pearson <markpearson@lenovo.com> - 2021-03-06 00:30 +0100
          Re: [External] Re: Debian and fingerprint readers Sam Hartman <hartmans@debian.org> - 2021-03-06 00:30 +0100
            Re: [External] Re: Debian and fingerprint readers Wouter Verhelst <wouter@debian.org> - 2021-03-06 17:30 +0100
              Re: [External] Re: Debian and fingerprint readers Paul Wise <pabs@debian.org> - 2021-03-07 03:40 +0100
              Re: [External] Re: Debian and fingerprint readers <tomas@tuxteam.de> - 2021-03-07 11:00 +0100
                Re: [External] Re: Debian and fingerprint readers Paul Wise <pabs@debian.org> - 2021-03-07 13:40 +0100
              Re: [External] Re: Debian and fingerprint readers Mark Pearson <markpearson@lenovo.com> - 2021-03-08 18:40 +0100
          Re: [External] Re: Debian and fingerprint readers Mark Pearson <markpearson@lenovo.com> - 2021-03-06 16:10 +0100

#12153 — Debian and fingerprint readers

Hi all,

Not sure the right forum to raise this - please redirect me as
appropriate :)

I was checking Debian on my Lenovo P1 G3 today (using testing latest)
and figured I'd have another stab at getting the fingerprint working -
something I've not had much success with previously on Debian.

It turned out to be really quite easy - just installed fprintd and
libpam-fprint and the reader is working nicely.

Is there any interest, as fingerprint reader functionality is now
improving so much on Linux, to have these packages installed by default?
All the new Linux certified Lenovo laptops should work - and I'm pretty
sure other vendors have the same. I'm not sure how it's decided which
packages are installed by default or if this is a controversial request :)

As an aside, the new Debian install is nice (touchpad works! Yay) and
getting my system up and everything important running (including the
microphone) was the easiest ever - thank you!

Mark

[toc] | [next] | [standalone]

#12156

On Wed, Feb 24, 2021 at 9:12 PM Mark Pearson wrote:

> Is there any interest, as fingerprint reader functionality is now
> improving so much on Linux, to have these packages installed by default?

Biometrics are almost always used incorrectly and often insecure or
easily hackable, it would be better to not subject our users to those
attacks by default.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#12158

On Thu, Feb 25, 2021 at 05:48:32AM +0000, Paul Wise wrote:
> On Wed, Feb 24, 2021 at 9:12 PM Mark Pearson wrote:
> 
> > Is there any interest, as fingerprint reader functionality is now
> > improving so much on Linux, to have these packages installed by default?
> 
> Biometrics are almost always used incorrectly and often insecure or
> easily hackable, it would be better to not subject our users to those
> attacks by default.

Yes, and we should do that in a way so that our users are not subject to
those attacks by default, but can still log in to their system by using
a biometric sensor, if the laptop provides that feature and they want
it?

-- 
To the thief who stole my anti-depressants: I hope you're happy

  -- seen somewhere on the Internet on a photo of a billboard

[toc] | [prev] | [next] | [standalone]

#12159

Hi,


> Yes, and we should do that in a way so that our users are not subject to
> those attacks by default, but can still log in to their system by using
> a biometric sensor, if the laptop provides that feature and they want
> it?

I'm very interested by this subject an would be happy to help.


Is there some resources in the debian project i should read aor any
maling list or group to joind ?


Kind regards

W.


-- 

William                             https://forum.armwizard.org

[toc] | [prev] | [next] | [standalone]

#12165

On Thu, Mar 04, 2021 at 04:55:21PM +0100, William Bonnet wrote:
> Hi,
> 
> > Yes, and we should do that in a way so that our users are not subject to
> > those attacks by default, but can still log in to their system by using
> > a biometric sensor, if the laptop provides that feature and they want
> > it?
> 
> I'm very interested by this subject an would be happy to help.
> 
> 
> Is there some resources in the debian project i should read aor any
> maling list or group to joind ?

There seems to be a "fingerforce" group, at
fingerforce-devel@lists.alioth.debian.org. I suggest you start there.

(honestly, I'm not sure of the details myself, I just wanted to point
out the obvious answer to Paul's statement)

-- 
To the thief who stole my anti-depressants: I hope you're happy

  -- seen somewhere on the Internet on a photo of a billboard

[toc] | [prev] | [next] | [standalone]

#12164

[Multipart message — attachments visible in raw view] — view raw

>>>>> "Mark" == Mark Pearson <markpearson@lenovo.com> writes:

    Mark> Hi all, Not sure the right forum to raise this - please
    Mark> redirect me as appropriate :)

    Mark> I was checking Debian on my Lenovo P1 G3 today (using testing
    Mark> latest) and figured I'd have another stab at getting the
    Mark> fingerprint working - something I've not had much success with
    Mark> previously on Debian.

    Mark> It turned out to be really quite easy - just installed fprintd
    Mark> and libpam-fprint and the reader is working nicely.

    Mark> Is there any interest, as fingerprint reader functionality is
    Mark> now improving so much on Linux, to have these packages
    Mark> installed by default?  All the new Linux certified Lenovo
    Mark> laptops should work - and I'm pretty sure other vendors have
    Mark> the same. I'm not sure how it's decided which packages are
    Mark> installed by default or if this is a controversial request :)

As you've seen  Debian as a whole is not the best at having discussions
like this.
Fortunately we're good at delegating.

I'm not sure we want these packages installed by default on a server for
example.

For an environment that is trying to compete with Mac or say ChromeOS, it seems
fairly clear we would want that feature.
The parts of Debian that are trying to do that are some of the desktop
environments.
So, I'd approach the maintainers of Gnome and KDE and see if they are
interested in recommending this functionality.

--Sam

[toc] | [prev] | [next] | [standalone]

#12166

On Thu, Mar 04, 2021 at 05:57:15PM -0500, Sam Hartman wrote:
> The parts of Debian that are trying to do that are some of the desktop
> environments.  So, I'd approach the maintainers of Gnome and KDE and
> see if they are interested in recommending this functionality.

It could also be added to the laptop task, which would mean it would be
installed by default on all laptops that are installed with debian-installer

Alternatively, d-i has some hardware detection functionality, to install
the correct drivers for hardware that is found. One could add entries
for supported fingerprint readers to the hardware detection in d-i, and
then install the necessary packages.

The hard part, however, is configuring all this so it works correctly
out of the box, also for users who don't want to use it.

-- 
To the thief who stole my anti-depressants: I hope you're happy

  -- seen somewhere on the Internet on a photo of a billboard

[toc] | [prev] | [next] | [standalone]

#12167

[Multipart message — attachments visible in raw view] — view raw

Wouter Verhelst <wouter@debian.org> writes:

> On Thu, Mar 04, 2021 at 05:57:15PM -0500, Sam Hartman wrote:
>> The parts of Debian that are trying to do that are some of the desktop
>> environments.  So, I'd approach the maintainers of Gnome and KDE and
>> see if they are interested in recommending this functionality.
>
> It could also be added to the laptop task, which would mean it would be
> installed by default on all laptops that are installed with debian-installer
>
> Alternatively, d-i has some hardware detection functionality, to install
> the correct drivers for hardware that is found. One could add entries
> for supported fingerprint readers to the hardware detection in d-i, and
> then install the necessary packages.
>
> The hard part, however, is configuring all this so it works correctly
> out of the box, also for users who don't want to use it.

For users that don't want to use it, I'd suggest that the only correct
answer is for them to never have had the software on their computer at
any point, given that it's security sensitive software, and any bugs may
well have the potential to hurt.

I presume if one installs this software, that even when the screen is
locked, when someone swipes a finger (or a specifically crafted toxic
pattern for that matter) on the reader, that something will be provoked
to run that would not have been run if it were not installed.

That seems like an increase in attack surface to me, that we should not
lightly inflict on unsuspecting users just because *shiny finger scanner*.

I'd expect that people that want their fingerprint scanners to be in use
are mostly aware of that fact, so as long as we make the optional
packages easily installable, that seems completely sufficient to me.

Cheers, Phil.
-- 
|)|  Philip Hands  [+44 (0)20 8530 9560]  HANDS.COM Ltd.
|-|  http://www.hands.com/    http://ftp.uk.debian.org/
|(|  Hugo-Klemm-Strasse 34,   21075 Hamburg,    GERMANY

[toc] | [prev] | [next] | [standalone]

#12175

On Fri, Mar 5, 2021 at 11:57 am, Philip Hands <phil@hands.com> wrote:
> Wouter Verhelst <wouter@debian.org> writes:
> 
>>  On Thu, Mar 04, 2021 at 05:57:15PM -0500, Sam Hartman wrote:
>>>  The parts of Debian that are trying to do that are some of the 
>>> desktop
>>>  environments.  So, I'd approach the maintainers of Gnome and KDE 
>>> and
>>>  see if they are interested in recommending this functionality.
>> 
>>  It could also be added to the laptop task, which would mean it 
>> would be
>>  installed by default on all laptops that are installed with 
>> debian-installer
>> 
>>  Alternatively, d-i has some hardware detection functionality, to 
>> install
>>  the correct drivers for hardware that is found. One could add 
>> entries
>>  for supported fingerprint readers to the hardware detection in d-i, 
>> and
>>  then install the necessary packages.
>> 
>>  The hard part, however, is configuring all this so it works 
>> correctly
>>  out of the box, also for users who don't want to use it.
> 
> For users that don't want to use it, I'd suggest that the only correct
> answer is for them to never have had the software on their computer at
> any point, given that it's security sensitive software, and any bugs 
> may
> well have the potential to hurt.
> 
> I presume if one installs this software, that even when the screen is
> locked, when someone swipes a finger (or a specifically crafted toxic
> pattern for that matter) on the reader, that something will be 
> provoked
> to run that would not have been run if it were not installed.
> 
> That seems like an increase in attack surface to me, that we should 
> not
> lightly inflict on unsuspecting users just because *shiny finger 
> scanner*.
> 
> I'd expect that people that want their fingerprint scanners to be in 
> use
> are mostly aware of that fact, so as long as we make the optional
> packages easily installable, that seems completely sufficient to me.

 From an earlier reply of Mark,
"It's just a case of needing the libfprint and fprintd packages 
installed
and then under settings->user you can start registering your prints."

So I think there is still a manual step required before this is active.

[toc] | [prev] | [next] | [standalone]

#12168 — Re: [External] Re: Debian and fingerprint readers

Thanks Sam & Wouter

On 05/03/2021 02:52, Wouter Verhelst wrote:
> On Thu, Mar 04, 2021 at 05:57:15PM -0500, Sam Hartman wrote:
>> The parts of Debian that are trying to do that are some of the desktop
>> environments.  So, I'd approach the maintainers of Gnome and KDE and
>> see if they are interested in recommending this functionality.
Unless I'm misunderstanding this - there's already support in Gnome for
it. Not sure about KDE (I was trying the latest plasma a couple of weeks
ago but didn't think about fingerprints...doh).

It's just a case of needing the libfprint and fprintd packages installed
and then under settings->user you can start registering your prints.

> 
> It could also be added to the laptop task, which would mean it would be
> installed by default on all laptops that are installed with debian-installer
> 
> Alternatively, d-i has some hardware detection functionality, to install
> the correct drivers for hardware that is found. One could add entries
> for supported fingerprint readers to the hardware detection in d-i, and
> then install the necessary packages.
> 
That sounds interesting - and smart. So we could detect the USB ID for
the reader and if it's a supported device install libfprint and fprintd
but not otherwise?
Could you point me at where that's done? I'd be interested in having a
poke around


> The hard part, however, is configuring all this so it works correctly
> out of the box, also for users who don't want to use it.
> 
Agreed - and that's what triggered this thread :) I just did install of
those two packages and it worked - which was pretty nice. There aren't
any hoops that needed jumping through.

It's not a big deal not doing this if this is controversial - but
fingerprint has been one of those features that I have I've been
surprised as to how popular and wanted it's been by linux users. There
is something nice about just tapping the reader and being logged in.

[toc] | [prev] | [next] | [standalone]

#12169 — Re: [External] Re: Debian and fingerprint readers

>>>>> "Mark" == Mark Pearson <markpearson@lenovo.com> writes:

    Mark> It's just a case of needing the libfprint and fprintd packages
    Mark> installed and then under settings->user you can start
    Mark> registering your prints.

Right, and the desktop maintainers could choose to make their desktop
meta packages depend on these two packages.
That was my point.

[toc] | [prev] | [next] | [standalone]

#12171 — Re: [External] Re: Debian and fingerprint readers

On Fri, Mar 05, 2021 at 06:13:58PM -0500, Sam Hartman wrote:
> >>>>> "Mark" == Mark Pearson <markpearson@lenovo.com> writes:
> 
>     Mark> It's just a case of needing the libfprint and fprintd packages
>     Mark> installed and then under settings->user you can start
>     Mark> registering your prints.
> 
> Right, and the desktop maintainers could choose to make their desktop
> meta packages depend on these two packages.
> That was my point.

While this true, it would mean that the fingerprint readers would only
work for those users who choose to install one of the desktops on their
system that adds this dependency.

If it is added to the laptop metapackage instead, then it will be made
available on all laptops, which are more likely than other hardware to
have a fingerprint reader.

If it is instead installed by hardware detection (through
https://salsa.debian.org/installer-team/hw-detect), then it will be
installed on all systems that have a fingerprint reader (and which don't
have it disabled in the BIOS, which you should do at any rate if you're
not interested in using it), regardless of whether they are a laptop,
desktop, or server. However, the downside to this method is that unless
there is a way to identify all fingerprint readers by way of a PCI or
USB attribute (and I have no idea whether this is possible), you'll have
to compile a list of vendor and product IDs, which by necessity will be
forever incomplete.

-- 
To the thief who stole my anti-depressants: I hope you're happy

  -- seen somewhere on the Internet on a photo of a billboard

[toc] | [prev] | [next] | [standalone]

#12172 — Re: [External] Re: Debian and fingerprint readers

On Sat, Mar 6, 2021 at 4:29 PM Wouter Verhelst wrote:

> If it is instead installed by hardware detection (through
> https://salsa.debian.org/installer-team/hw-detect),

I think that the isenkram package is meant to replace this, it relies
on the packages containing hardware support announcing this fact via
AppStream files though:

https://wiki.debian.org/USB/GadgetSetup
https://wiki.debian.org/AppStream/Guidelines#Announcing_supported_hardware

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#12173 — Re: [External] Re: Debian and fingerprint readers

[Multipart message — attachments visible in raw view] — view raw

On Sat, Mar 06, 2021 at 06:24:49PM +0200, Wouter Verhelst wrote:

[...]

> If it is instead installed by hardware detection (through
> https://salsa.debian.org/installer-team/hw-detect), then it will be
> installed on all systems that have a fingerprint reader (and which don't
> have it disabled in the BIOS, which you should do at any rate if you're
> not interested in using it) [...]

So the fingerprint reader has to be present at install time. Those
buying a reader after install (there /are/ external USB FP readers)
are recommended to re-install Debian ;-P

Of course, this is meant tongue-in-cheek: I just wanted to shed
light into that wrinkle.

Surely there is some "canonical" way of dealing with "oh, this shiny
piece of hardware has just appeared; what do you want to do with
it?".

Cheers
 - t

[toc] | [prev] | [next] | [standalone]

#12174 — Re: [External] Re: Debian and fingerprint readers

On Sun, Mar 7, 2021 at 9:52 AM <tomas@tuxteam.de> wrote:

> Surely there is some "canonical" way of dealing with "oh, this shiny
> piece of hardware has just appeared; what do you want to do with
> it?".

The isenkram package is meant to do this, it relies on the packages
containing hardware support announcing this fact via AppStream files
though:

https://wiki.debian.org/USB/GadgetSetup
https://wiki.debian.org/AppStream/Guidelines#Announcing_supported_hardware

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#12177 — Re: [External] Re: Debian and fingerprint readers

On 06/03/2021 11:24, Wouter Verhelst wrote:
> On Fri, Mar 05, 2021 at 06:13:58PM -0500, Sam Hartman wrote:
>>>>>>> "Mark" == Mark Pearson <markpearson@lenovo.com> writes:
>>
>>     Mark> It's just a case of needing the libfprint and fprintd packages
>>     Mark> installed and then under settings->user you can start
>>     Mark> registering your prints.
>>
>> Right, and the desktop maintainers could choose to make their desktop
>> meta packages depend on these two packages.
>> That was my point.
> 
> While this true, it would mean that the fingerprint readers would only
> work for those users who choose to install one of the desktops on their
> system that adds this dependency.
> 
> If it is added to the laptop metapackage instead, then it will be made
> available on all laptops, which are more likely than other hardware to
> have a fingerprint reader.
> 
> If it is instead installed by hardware detection (through
> https://salsa.debian.org/installer-team/hw-detect), then it will be
> installed on all systems that have a fingerprint reader (and which don't
> have it disabled in the BIOS, which you should do at any rate if you're
> not interested in using it), regardless of whether they are a laptop,
> desktop, or server. However, the downside to this method is that unless
> there is a way to identify all fingerprint readers by way of a PCI or
> USB attribute (and I have no idea whether this is possible), you'll have
> to compile a list of vendor and product IDs, which by necessity will be
> forever incomplete.
> 
libfprint have a list of all supported devices which should be helpful -
based on USB ID:

https://fprint.freedesktop.org/supported-devices.html

Mark

[toc] | [prev] | [next] | [standalone]

#12170 — Re: [External] Re: Debian and fingerprint readers

On 05/03/2021 18:14, Sam Hartman wrote:
>>>>>> "Mark" == Mark Pearson <markpearson@lenovo.com> writes:
> 
>     Mark> It's just a case of needing the libfprint and fprintd packages
>     Mark> installed and then under settings->user you can start
>     Mark> registering your prints.
> 
> Right, and the desktop maintainers could choose to make their desktop
> meta packages depend on these two packages.
> That was my point.
> 
Ah got it - sorry, didn't realise that's how it works.
Thanks for the clarification.
Mark

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.project

csiph-web