Why does Gnome fingerprint unlock not unlock the keyring?

https://mjg59.dreamwidth.org/68537.html

by ingve • 3 years ago

104 76 3 years ago

mjg59.dreamwidth.org

baybal2• 3 years ago

And that's the difference. When you perform TouchID authentication, the secure enclave can decide to release a secret that can be used to decrypt your keyring. We can't easily do this under Linux because we don't have an interface to store those secrets.
The secret material can't just be stored on disk - that would allow anyone who had access to the disk to use that material to decrypt the keyring and get access to the passwords, defeating the object.

I'll provide a broader explanation: you cannot encrypt your key with a fingerprint.

A genuine "throw away the key" lock is only possible when the decryption key is completely erased from memory during the screen lock, and you cannot use your fingerprint or face image as a key by itself.

A screen lock using stored secret is inherently incapable of providing encryption at rest. It's like a password on a sticky note.

A "throw away the key" is only possible with a password, or a smartcard.

parker_mountain• 3 years ago

I'm not sure if you're familiar with how Touch ID and the secure enclave works?

mjg594• 3 years ago

If you trust the hardware then it's entirely possible to tie the release of an encryption key to a fingerprint validated by that hardware. Hardware-backed keys are widely used (the entire WebAuthn ecosystem is predicated upon them being trustworthy), and having that hardware validate a fingerprint rather than merely physical presence is an improvement.

RockRobotRock• 3 years ago

As far as physical attacks go, we only trust secure elements because they're tiny and very difficult to reverse engineer, right?

westurner• 3 years ago

https://news.ycombinator.com/item?id=33311523 :

[WebAuthn, TPM, U2F/FIDO2, Seahorse,]
tpm-fido: https://github.com/psanford/tpm-fido :
> tpm-fido is FIDO token implementation for Linux that protects the token keys by using your system's TPM. tpm-fido uses Linux's uhid facility to emulate a USB HID device so that it is properly detected by browsers.

TPM > TPM software libraries: https://en.wikipedia.org/wiki/Trusted_Platform_Module#TPM_so...

TPM > Virtualization; virtual TPM devices: https://en.wikipedia.org/wiki/Trusted_Platform_Module#Virtua...

WebAuthn: https://en.wikipedia.org/wiki/WebAuthn

mrintegrity• 3 years ago

I was wondering that myself, and just this moment tested it. Interestingly, I pressed cancel on the keyring dialog instead of entering a password.. everything seems to work fine!? I can view saved passwords for wifi networks in gnome network manager, firefox passwords can be viewed in it's manager too. So what exactly does this system protect?

It seems I have either misunderstood it's functionality or it's completely broken. Is it literally only protecting the "login keyring", in which case what is the point when I can still login and seemingly do everything anyway?

In the gui "seahorse" I can view all openssh and gpg keys without having unlocked the login keyring.. very confused by this!

oynqr• 3 years ago

NetworkManager can save credentials for all users, which is probably your case, and the others don't use the system keyring by default.

yrro• 3 years ago

I can view saved passwords for wifi networks in gnome network manager,

These are stored system-wide, within NM's connection profiles (likely /etc/NetworkManager/system-connections/whatever.nmconnection).

In the gui "seahorse" I can view all openssh and gpg keys without having unlocked the login keyring

This is unlocked when you first log in, or unlock your session (pam_gnome_keyring.so stashes the password when called from 'auth' and retrieves it & uses it to unlock the user's keyring when called from 'session'); but I don't believe the keyring is locked when the session is locked, only when the system suspends/hibernates.

Karliss• 3 years ago

OpenSSH keys have their own passwords. On my system there are a few things that are stored within login keyring: chromium safe storage for various electron based programs (Chromium itself, discord, vscode, unity hub), password or login token for Element (matrix client), svn password, login credentials for VM which was created using Gnome Boxes. All of which might be a software that you don't use or use in different configuration.

But since I don't have a fingerprint reader i can't verify that those things wouldn't work when logging in without password.

Edit: as a test I deleted the secrets stored by discord and Element, after restarting the programs both of them were able to login without reentering password. So while they are storing something within login keyring, it doesn't seem to be anything important, and actual credentials are stored elsewhere.

3np• 3 years ago

Theoretically, if using the "it passes a graphical representation of the fingerprint back to the OS" models, it could be done if assuming a method to reliably derive strong cryptographic keys from a fingerprint scan.

Reliably mapping to the same key while not dropping down to abysmal entropy probably makes this intractably, hence the need for a TPM.

knallfrosch• 3 years ago

This doesn't explain why Linux doesn't communicate with the secure enclave. Edit: I suspect closed-source hardware drivers, or collaboration with manufacturer is needed - so no fault on the Linux team, but still, an explanation as part of the article would be welcome.

As an aside, Appleland isn't the promised land either.

Apple laptops with a fingerprint reader lack the interface to be unlocked with depth cameras, like any Windows Hello certified camera. This means biometric authentication requires another connected fingerprint reader when the lid is closed.

Apple phones on the other hand have the opposite problem. They have a depth camera and can use your face to unlock, but lack the hardware for fingerprint unlocking. This means you have to lift them up and point them at your face while other phones have built-in fingerprint readers beneath their screens.

ho_schi3• 3 years ago

The cameras - i.e. FaceID - on the iPhone are unlocking the iPhone prematurely (to early).

Why?

Because they unlock the device in advance before you request it by action. Watch the small lock. It unlocks before you swipe up.

Example?

You ask a stranger to take a photo of your group. I think a normal situation. Not an issue with an iPhone SE (1st Gen - 3rd Gen). Just open the camera app from the lock screen and pass it, the photographer just needs to know “red button” and cannot access anything. Same with FaceID? You’re likely in trouble because you probably didn’t covered the front camera while passing the smartphone - it is completely unlocked because FaceID unlocks the device as soon as it recognizes the you. Apple has broken a security promise which we all know and expect. And usually the screen turns on when the phone is picked up (FaceID starts searching) and even if not - by habit many will touch the side-button and launch the camera app from the lock—screen.

Workaround?

Turn FaceID off. Or always remember not to look at the device and cover cameras with your fingers (FaceID can be quick). Guess what? Only the first one works for me.

Previously?

Stealing an iPhone handed over for photography was useless. Investigating private data was not possible.

Please note that an unlocked iPhone allows access to all data. And resetting your passwords via E-Mail. I don’t know if the E-Mail is enough to reset the Apple ID.

I’m afraid FaceID was considered too slow by Apple and they decided to make it “feel faster” by scanning for the owner already before the owner swipes up to unlock. It could be secure - only unlock if the user actually requests it by swiping up. The tiny “lock icon” also part of the problem. Within iOS itself a use of FaceID is much more obvious, users note when it is happening.

PS: GNOME and seahorse are nice - when you login in with password it is automatically unlocked. It handles changes of the password also through the shell well, it recognizes the mismatch and ask only once for the old password. Maybe the reason why I didn’t feel the need for “password managers”.

lloeki3• 3 years ago

Or always remember not to look at the device and cover cameras with your fingers (FaceID can be quick)

Picture this:

- Owner hands over phone locked (whether or not in camera)

- Photographer sort of takes its time, acting not too sure about themselves to divert attention while subtly manipulating device so that screen shuts down (wait for screen sleep, or press power button if in camera), claims "oh I made a mistake / screen has shut down" or something to that effect all the while smoothly presenting device as if both demonstrating the fact and asking for help, facing it towards owner so that they can look, yet quickly presses power button which kicks in FaceID which provides haptic feedback as a cue to swiftly turn it around, swipe up, and keep a finger on screen. Photographer runs away, phone is unlocked.

What works: press power button five times, dismiss emergency screen, and only then hand it over. This invalidates authentication and requires pin to unlock (think `sudo -k`).

M4v3R• 3 years ago

Stealing an iPhone handed over for photography was useless

Was this ever a thing? I've never heard about a phone handed over for photography being stolen. I'm sure it probably happened to someone somewhere, but I don't think it's a big enough problem to re-engineer how the phone works to prevent it.

bandrami• 3 years ago

This would only work if you could somehow reliably produce a predictable string of some sort from the scan of a fingerprint, but you can't. Unless it's decrypting the keychain by an artifact of the scanning process itself, the password is stored and available somewhere on the computer, in a "secure enclave" or not. And I don't want that. If the finger scanner is just the warden of something that has the power to unlock the keychain without the password that is only stored in my grey cells, then someone can shim a fake finger scanner that pretends to have found a match.

ycombinatrix• 3 years ago

biometric yubikey seems to be a viable solution

captainmuon3• 3 years ago

There are protocols that you can use to authenticate the fingerprint scanner [1]. When they are not used you can indeed just shim a fake scanner and unlock the PC [2].

This all assumes that nobody can break into the secure silicone of the the fingerprint scanner (or the PC) of course, but that is a pretty high bar.

[1] https://github.com/microsoft/SecureDeviceConnectionProtocol

[2] https://www.theverge.com/2023/11/22/23972220/microsoft-windo...

captainmuon3• 3 years ago

Couldn't you have a small (meaning auditable) priviliged daemon store the keys in RAM when the keychain is unlocked once? The daemon would then release the keys when it determines that the fingerprint is correct.

You would have to compare the fingerprints on the PC, or you would have to have a authenticated channel between the fingerprint reader and the PC, otherwise you would open yourself to device spoofing attacks. I think an attack like that was discovered recently for Windows notebooks.

This scheme would mean that root can access your keys without the fingerprint (unlike on a Mac I think), but the root account already has other ways to get your passwords.

Similar, you might be vulnerable against an attack where somebody confiscates your locked PC, freezes your RAM modules, and reads them out later. But you could encrypt the passwords in locked state using the TPM to make this much more difficult. And again, people who can do these attacks have much easier ways of getting your passwords, such as rootkits, or simply forcing you to put your finger on the sensor.

mjg594• 3 years ago

How are the secrets kept secret? If the encryption key is stored on disk then giving me physical access lets me extract that and gain all the secrets. The TPM has no knowledge of the biometric state so doesn't help here.

Sebb767• 3 years ago

I think OP means that you enter your password to unencrypt your keyring once at boot or first use and then keep the keys in RAM. So you could not access the data when you steal the laptop while powered off, making it practically as safe as full-disk encryption.

arianvanp• 3 years ago

Yet Microsoft unlocks the Keyring with the exact same fingerprint readers.

Microsoft pushed the reader industry to adopt their protocol almost 6 years ago and it's universally implemented in almost all laptops (citation needed; maybe I'm wrong here and it's not as universal).

They even have an open source reference implementation - https://github.com/microsoft/SecureDeviceConnectionProtocol - https://github.com/Microsoft/SecureDeviceConnectionProtocol/...

Yet Fprintd still doesn't support it to date. https://gitlab.freedesktop.org/libfprint/libfprint/-/issues/...

So the problem really isn't with the fingerprint readers (at least on modern laptops) it's that fprintd is horribly outdated with current tech

The other problem with Linux is that SDCP needs to be implemented in tandem with TPM support. Another area where Linux Distros are at least 10 years behind Windows.

However systemd has been slowly making strides with PCRLock

I am also pretty sure (but citation needed) that Microsoft has fallback code for image-matching fingerprint readers that run that code in a VM in some kind of trusted execution environment so that Windows Hello also works on old fingerprint readers

noja• 3 years ago

it's that fprintd is horribly outdated with current tech

This current tech? https://www.theregister.com/2023/11/22/windows_hello_fingerp...

arjvik• 3 years ago

If an attacker has physical access long enough to connect a MITM on your fingerprint reader, it's not your laptop anymore.

mjg594• 3 years ago

SCDP describes a driver-level API, it doesn't tell you how to talk to the actual hardware. Vendors ship Windows drivers that implement that API but I'm not aware of any who've documented it. And while SCDP provides a secure communication channel with the biometric device, in itself that doesn't give you an ability to seal secrets to that device based on the biometric data.

creshal2• 3 years ago

My 2 year old laptop's fingerprint reader still doesn't work in Linux: Its native resolution is too high for the driver to handle, and somehow that's been an unfixable problem for years now.

mariusor2• 3 years ago

Another area where Linux Distros are at least 10 years behind Windows.

I don't really understand the way that people who apparently should know better still frame the issue as a "Linux" problem, instead of a "hardware vendors" problem.

When vendors cooperate, open-source is on par with other OSs (see AMD and Intel), but when they don't then it's amazing that things are working to the level that they do, and I am thankful.

NoLsAfterMid5• 3 years ago

I don't get the distinction. Linux has to run on the hardware, no?

continuational• 3 years ago

It's simply because hardware vendors don't have a big problem with the state of hardware, but Linux users do.

rodrigodlu• 3 years ago

Do you know any workarounds to make Windows not ask me to login on a Ms account whenever I try to setup the fingerprints?

Using my Fedora installation on a XPS Plus was plug and play, no login needed.

I have a Samsung Book with Windows 11 that I can't do the same. :(

dannyw• 3 years ago

I have an Acer laptop with fingerprints and without a MS account.

I entered the wrong password to a fake MSFT account and that let me create a local account.

Setting up fingerprint scanning was part of the OOBE.

If this isn’t possible for you, try downgrading to Win10, setting it up, and upgrading.

tinus_hn3• 3 years ago

Take a look at how secure Microsoft’s solution really is:

https://www.theverge.com/2023/11/22/23972220/microsoft-windo...

eimrine• 3 years ago

The other problem with Linux is that SDCP needs to be implemented in tandem with TPM support. Another area where Linux Distros are at least 10 years behind Windows.

Let me disagree, I think this is a problem of capitalism, not Linux. TPM is a closed-source technology, defective by design.

hulitu• 3 years ago

Another area where Linux Distros are at least 10 years behind Windows.

I don't think that my computer requires a fingerprint sensor to function.

AshamedCaptain• 3 years ago

Typical over engineering that would worry about stealing the encrypted hard disk when discussing about a fingerprint scanner that would only really take a couple minutes to fool for the determined attacker...

When did we forget that biometrics were supposed to be a convenience and not a replacement for true authentication against any real adversary? As the entire concept of using irreplaceable parts of yourself as key is broken since the start...

Who is the adversary here? The point of all this is to at best protect against untrained thief, but with biometrics, never against anything more...

thaumasiotes• 3 years ago

When did we forget that biometrics were supposed to be a convenience and not a replacement for true authentication against any real adversary?

Before the first guy started implementing biometric unlock. If you can use it to unlock things, then it is an upper bound on the security level for whatever it can unlock.

As the entire concept of using irreplaceable parts of yourself as key is broken since the start...

Yes, obviously. A password that can never be changed is a huge security downgrade from a normal password.

fsckboy• 3 years ago

just an interesting side point, your fingerprint lives persistently in the fingerprint reader, rather than "in your computer": by analogy, what I mean is something like, "if your fingerprint reader is in your mouse, then your fingerprint lives in your mouse, not at the other end of the wire plugged into the computer."

I know this because I own a bunch of Thinkpads and I swapped out a keyboard for one that had been unused for several years, and my fingerprint came back piggyback. I had to configure the password change, but I didn't have to retrain it on my fingerprint. (the fingerprint reader circuit board lives right under the touchspot, and plugs into the motherboard via a short cable; the motherboard and OS installed had no notion of fingerprints before this because the keyboard I swapped out did not have a fingerprint reader)

Not sure if that's a security issue for discarded hardware? but I found it quite strange.

mcpackieh4• 3 years ago

Simply put: The intersection of "values Linux", "has the technical chops to implement it" and "thinks using fingerprints is actually a good idea" is an empty set.

Maybe some people in this thread think they're in that intersection, but I don't think anybody actually is.

freedomben• 3 years ago

I would put myself in that set, but it depends on what you want to use the fingerprint for whether it's a good idea.

I prefer things exactly as they are currently. I don't want my fingerprint reader to be able to unlock the keychain. However, I do use it for quickly unlocking a laptop who's keychain is already unlocked. I do this probably 10 to 15 times a day. If I had to type my long-ass password every single time, then I start to not want to lock the laptop if I'm only running to the bathroom or something, which is a very bad practice.

mcpackieh4• 3 years ago

Okay, fair. I should have said: "thinks using fingerprints [to unlock their keychain] is actually a good idea"

Why does Gnome fingerprint unlock not unlock the keyring?

Related Stories