Once upon a time, there was a bit of a fad for fingerprint authentication in laptops and desktop computers. It has long since faded, but [superdog] wanted just such a device for Linux and Mac machines. Thus, it was time to build one.
[superdog] designed the device, nicknamed immurok, as a tool for people who use external keyboards, and do lots of terminal work on Mac and Linux machines. Repeat password requests can interrupt one’s flow when hustling at the keys, so immurok was designed to ease this pain.
The device is based on a WCH CH592F microcontroller, which comes with Bluetooth connectivity out of the box. This allows immurok to connect wirelessly to the machine of your choice, advertising itself as a standard Bluetooth HID keyboard device. Fingerprint-wise, scanning is done with an R559S capacitive sensor, which verifies the match locally so there’s no transmitting biometric data anywhere. On the computer side, Linux is setup to use a CLI/TUI app plus PAM integration to handle authorization for system logins and sudo in the terminal. On the Mac platform, it’s used with a menu bar app, with PAM integration for admin prompts. There’s also a separate helper path for using it with the lock screen.
If you’re sick of entering your password all the time and wish unlocking your PC was more like unlocking your phone, this might be the project for you. We’ve seen similar projects before, too. If you’re whipping up fun gear for biometric auth, don’t hesitate to let us know on the tipsline.
Surprise! The firmware repo is 404 :-(
Sorry, I set it private because some compiler issues. I will open it in 1-2 days.
It would be nice to extend this to U2F so that it can be used for more than just opening screen lock. But I’m not sure how well U2F over bluetooth works on Linux yet.
But is it securely transmitted?
I was pretty impressed by the key generation etc but then i read in the end its a BLE HID device typing the password…
I design low power industrial IoT devices and it’s not difficult to get sub 4uA sleep current with the right tricks. That alone can extend the standby time to nigh infinite (very long, i mean). But then again i use Nordic MCUs (which are excellent hardest wise, but i have to use the dreaded Zephyr RTOS with them). I also use STmicro MCUs, they are very decent, but their peripheral documentation could stand to importing. Still, they’re much not powerful hardware wise than Nordic MCUs.
The enclosure is beautiful, and i love the overall aesthetic.
Not really. In most of the cases, it uses secure data signature to verify itself and makes the authentication, including ssh, git, screen unlock on Linux. Only for mac screen unlock, it triggers a daemon app to send password to the screen unlock input. But the password is stored in you mac keychain instead of the device.
i am skeptical this works on mac though… most research for a mac finger print unlock leads back to decomposing a mac keyboard. unless this is like injecting the password…
Yup, because Macs store the biometric derived stuff in the Secure Enclave, and the reader just sends what it reads back to that.
This reads the fingerprint, decides if it’s a match, and then sends the password over BT. So it’s a device with your password stored in it… 😬
It uses PAM to do the authentication. No password is using on Linux and macos except the screen unlock scenario. And the password is stored in mac keychain, not in the device. You can read the secure model for more information https://immurok.com/blog/the-immurok-security-model/
Wireless and security are usually antithetical, especially when it comes to Bluetooth. I feel like thos would be fairly easy to snoop in on packets.
The irony that biometric identification used to be a cool new fad, but now we are having it forced into our lives. I guess the big difference, it used to be new to the public, it felt advanced, sci-fi made real. Very few saw the dystopia, because it was ours, used for our own benefit or amusement, now it’s a pervasive black box, used to keep tabs, that for most snuck in like a Trojan horse.
Until you build a hat and license plate frames w high wattage UV and IR LEDs you’re just raving conspiracies on the net.
I should build/add an e-ink bumper sticker that updates about once/minute, just to F with big brother on the pole.
But humans leave there password (fingerprint) EVERYWHERE.