16

I've recently obtained a new notebook, specifically a Thinkpad. Now I found out that it has a fingerprint reader integrated into the power button. I am skeptical about biometrics as a security mechanism. But I'm wondering, apart from its suitability for preventing unauthorized access, could the fingerprint reader itself pose a source of danger to my privacy?

Let's say I'd find a reasonable use case for the sensor and started using it. Then, there might be biometric information of me stored on the device. Ideally, it would be stored in a way that is not accessible from outside, neither by software nor by hardware. But from what I've read, biometric sensors are usually secured by obfuscation, which makes them hard to trust. The sensor in question is from Goodix, but I couldn't find much useful information about the manufacturer. Is it reasonable to entrust one's biometric information to such a device?

9
  • 4
    "Is it reasonable to entrust one's biometric information to such a device?" - given how much such sensors are available and how much use is propagated even in companies, it looks like it is reasonably trustworthy for some relevant threat scenarios. If it is sufficiently trustworthy in your specific but totally unknown threat scenario is impossible to say though. Oct 17, 2023 at 14:31
  • 1
    I'd hope fingerprint scanners are better than they used to be. Mythbusters was able to beat a computer finger print scanner just starting with a latent and making a gel fingerprint. youtube.com/watch?v=MAfAVGES-Yc
    – thaspius
    Oct 17, 2023 at 19:15
  • 22
    I would just like to point out that you are leaving a copy of this particular biometric information behind every time you touch any smooth surface with bare hands. Oct 17, 2023 at 22:41
  • 4
    If you are concerned about software storing information about your fingerprint when you touch a button then it would make sense to also be concerned about actual physical fingerprints (latent fingerprints) you are leaving on the buttons and other parts of the laptop, and other things you touch throughout the day as these could also be found and lifted by other people with access to your belongings. Oct 18, 2023 at 6:17
  • 2
    Well, I usually don't care about fingerprints and DNA left on my devices. This is because I don't expect anyone in my environment to plot evil plans against me. My concern was more that digitally storing biometrics might potentially open new doors for identity theft through anonymous remote attacks. But the answers have largely resolved this concern. Oct 18, 2023 at 11:18

5 Answers 5

36

It's certainly possible that the fingerprint reader contains some kind of backdoor or malicious code. But that's also true of the motherboard, the network card(s), the camera and microphone, the CPU, the device firmware, the device drivers, and every part component in the laptop.

So if you don't trust Lenovo not to ship you a backdoored fingerprint reader (either intentionally or through a failure of their own supply chain security), then you shouldn't trust any other part of the laptop either.

19
  • 26
    If the computer is backdoored and your password is stolen, it can be revoked (changing the password). You can't change your fingerprints, so the security of biometrics are higher stakes (real or perceived). This is precisely why there are requirements for fingerprint readers to be match-on-sensor and don't expose the raw biometrics to the rest of the platform.
    – user71659
    Oct 17, 2023 at 18:07
  • 18
    @user71659: You leave your fingerprints, and your DNA, all over everything, just by living a normal life. It might be impractical for some attackers to retrieve some specific fingerprints or DNA samples, but it is probably safest to assume that a sufficiently motivated and physically-nearby attacker can obtain nearly any biometric data they want.
    – Kevin
    Oct 17, 2023 at 18:49
  • 11
    @Kevin Sure, that's why there's a perceived privacy risk. Nonetheless, it's worth protecting against remote attackers. That's the issue with this answer: it doesn't distinguish levels of sensitivity and levels of attack. "It could be compromised so everything is screwed" is the wrong approach in modern security.
    – user71659
    Oct 17, 2023 at 19:34
  • Well, this answer makes a perfectly good point. I've just never thought of fingerprints as something to use as computer input. My natural response was to be wary of potential privacy issues. But I can see now that this is probably more of a psychological issue rather than a technical one, as I trust my devices with all my other data as well. Oct 17, 2023 at 21:16
  • 2
    I mean, it's not unreasonable to mistrust Lenovo after they shipped a whole line of products with Superfish malware installed, which not only caused ads to be served throughout the system, but also caused the computer to trust a root CA whose private key was bundled with the software.
    – A. R.
    Oct 18, 2023 at 16:03
19

On modern Windows systems, biometric authentication (including fingerprints) is handled by Windows Hello, which makes it basically as trustworthy as the rest of the system, and leaves less room for a vendor (in this case, Lenovo and/or Goodix) to do privacy-compromising things.

Fingerprint readers can operate in one of two ways:

  • Software verification, where the sensor simply passes the raw fingerprint data to userland software for verification.
  • Hardware verification ("Enhanced Sign-in Security"), where the fingerprint model is stored in the fingerprint reader module itself, and the hardware performs verification internally, and raw data is not passed to userland.

See here if you want to determine which mode your system supports.

Microsoft also provides this documentation about how Windows Hello works, which includes information about how biometric data is stored:

Where is Windows Hello data stored?

The biometric data used to support Windows Hello is stored on the local device only. It doesn't roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data from a device, it cannot be converted back into a raw biometric sample that could be recognized by the biometric sensor.

Note: Each sensor on a device will have its own biometric database file where template data is stored. Each database has a unique, randomly generated key that is encrypted to the system. The template data for the sensor will be encrypted with this per-database key using AES with CBC chaining mode. The hash is SHA256. Some fingerprint sensors have the capability to complete matching on the fingerprint sensor module instead of in the OS. These sensors will store biometric data on the fingerprint module instead of in the database file.

Finally, Microsoft manually reviews fingerprint reader drivers before they can be distributed, so there's hopefully at least some level of assurance that your fingerprint hardware vendor isn't doing anything nefarious.

So:

  • Your fingerprint data is always stored locally and never (intentionally) uploaded anywhere.
  • The data is either stored in an on-disk database that is encrypted with a device-unique key, or in hardware where it is presumably not exportable or accessible to any software.
  • Matching is performed by the operating system or the hardware.
  • The data which is stored (whether in a database file or in hardware)—much like a password hash—cannot be used to reconstruct the original fingerprint.

Given the above, I see no reason to trust a fingerprint reader any less than the rest of your system. At the end of the day, the fingerprint reader is just an input device the same as your keyboard, mouse, camera, and microphone, and each of those devices and/or the regular files stored on disk are arguably much more attractive as a means of violating your privacy.


On Linux, fingerprints are handled by the fprint project, which anyone can audit for trustworthiness if so inclined.

On Macs, Touch ID functions largely similarly to Windows:

The chip in your device includes an advanced security architecture called the Secure Enclave, which was developed to protect your passcode and fingerprint data. Touch ID doesn't store any images of your fingerprint, and instead relies only on a mathematical representation. It isn't possible for someone to reverse engineer your actual fingerprint image from this stored data.

Your fingerprint data is encrypted, stored on disk, and protected with a key available only to the Secure Enclave. Your fingerprint data is used only by the Secure Enclave to verify that your fingerprint matches the enrolled fingerprint data. It can’t be accessed by the OS on your device or by any applications running on it. It's never stored on Apple servers, it's never backed up to iCloud or anywhere else, and it can't be used to match against other fingerprint databases.

2
  • 1
    Thank you for the detailed explanation! It's good to know that devices usually only store derivative information for matching rather than the raw biometrical data itself. Oct 18, 2023 at 12:30
  • "It isn't possible for someone to reverse engineer your actual fingerprint" in a reasonable amount of time. Yet.
    – FreeMan
    Oct 20, 2023 at 12:19
5

You don't have to store the fingerprint for this. You can simply store a model, that only gives a positive result for the correct fingerprint. This is similar to how people don't store passwords, they store a function that can verify the password.

I can't speak for how your laptop in particular implements this. Maybe their programmers suck and they really do store the fingerprints. That would make your concern valid. But generally that is not how a normal developer would set up fingerprint verification - it's well known that you shouldn't store the fingerprint.

Furthermore, there are usually laws about storing biometric data specifically. These can be more strict than even storing passwords. So if you're worried about giving up your fingerprint data, you should look into those for your jurisdiction.

As for: Is there a way someone who isn't you could get past the fingerprint reader? Yes, of course. No security is perfect.

  • They could get your fingerprint and make a fake finger of their own
  • They could somehow force or trick you into pressing you finger on the reader
  • They could find a bug in the software/hardware and get past without providing the right print

Also, there are risks as well: You could lose the finger (in an accident) and be unable to unlock it yourself. The software they use may be bad and fail to recognize your fingerprint even though it's correct.

But similar things also apply to similar systems, like passwords or keycards. So fingerprints are not particularly better or worse than the alternatives. Unless perhaps you work in a factory that has horrible OSHA compliance.

Regarding your concern about learning the details of how the hardware/software works, welcome to the problems of proprietary tech. If the software was FOSS and the hardware was open (schematics available) that would not be a problem. However, making things proprietary can make the company more money, so it's harder to find FOSS alternatives because the proprietary vendors have more money to spend on marketing and development. You should still look for FOSS options if you care.

5
  • 3
    Proprietary technology is certainly problematic in the context of security. But unfortunately, security by obfuscation continues to be economically attractive. Oct 17, 2023 at 21:37
  • 7
    Little known fact - twins don't have the same fingerprints. Your evil twin will be no help. Oct 18, 2023 at 2:37
  • 3
    @MarkRansom But identical twins can share face-recognition (which is also an option for Windows Hello). Oct 18, 2023 at 8:40
  • 2
    @AndrewLeach Interesting, on its 2015 launch Windows Hello demonstrated that it can tell identical twins apart since the IR image is still different, but I googled around and apparently at least one person in 2020 claimed it unlocked for their twin (no verification though, and I don't see it's picked up by any news). Wonder if something changed between updates.
    – Martheen
    Oct 18, 2023 at 15:21
  • 1
    For non-USAns, OHSA is their "Occupational Safety and Health Administration". Oct 19, 2023 at 9:45
2

I have experience with fingerprint identification systems and fooling them as my senior thesis in college. I will discuss what I discovered during this project years ago.

Modern security is based on 3 principles: Confidentiality, Integrity, and Availability. Biometric authentication on it's own while it is great on availability, it violates the other two principles.

First we will discuss confidentiality. Your fingerprints are not a secret. Everything you touch leaves them behind. The veins in your eyes are not a secret, hidden cameras that are good enough could pick them up at a distance without you knowing. All it would take is someone having you touch a mug of an offered drink, and then reclaiming the mug while preserving where you touched it, and now they have your fingerprint. All that is left is to reproduce it in a format that will fool the scanner.

Integrity is next. Your fingerprints must identify only you. If they do not, they must be able to be changed. I can't go into the legality outside of the US, but changing your fingerprints is against the law in the US. As such, it violates integrity as a result. So once someone has a reproduction of your fingerprint, you have no legal recourse to change it.

Now, as far as whether or not all of this is necessary, it is in fact not if we want to fool your scanner. In my senior thesis project we used generative AI to produce fingerprints that fooled scanners to appear as 90%+ of all users in a fingerprint reader's database. One fingerprint generated could unlock almost anyone's account. So we don't even need you to get into your laptop.

I cannot provide a paper for my senior thesis as there is none, but we did base it off of this paper: https://arxiv.org/abs/2106.11760

Is your laptop or phone secure using fingerprint authentication alone? No. It is not. Biometrics is best left for identification purposes, not authentication.

Can your fingerprint scanner be trusted? It can be trusted to read your fingerprint, but that is all it can be trusted to do. It can't be trusted to properly identify you if a properly equipped attacker comes to it.

0

If your concern is the possibility that your biometric data could be leaked, then it is worth considering that you are leaving this sort of data around all the time. Rather than hacking into your laptop's fingerprint sensor to steal your fingerprint data, a possible attacker could follow you into a cafe and collect your fingerprint from a mug. Similar reasoning applies to other kinds of biometric data.

Biometric authentication may be good against unsophisticated adversaries, but even then it would be prudent to use it in tandem with non-biometric authentication factors.

3
  • Who needs a mug? The laptop is almost surely covered in fingerprints.
    – JimmyJames
    Oct 19, 2023 at 20:27
  • 1
    Mug is better than laptop for several reasons: (1) its surface is smooth compared to that of the laptop so it should be easier to source a fingerprint from it (2) the target is likely aware of what is going on with the laptop and won't let anyone collect fingerprints off it, while target's mug is left in the cafe for cafe's personnel to remove -> collecting the mug before a waitress and without the target noticing is trivial. Oct 20, 2023 at 7:57
  • Of course we're always leaving biometric data in our environment. But nowadays, identity theft predominantly occurs in the context of cybercrime. So I think it's reasonable to consider the scenario of an anonymous remote attacker who might exploit digitized biometrics. However, as I said in my other comments, this concern has been resolved. Oct 20, 2023 at 8:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .