IBM/Lenovo External Fingerprint USB?

[NathanA]

All,

I'm looking around for a good external fingerprint reader for someone who wants to add one on to their computer.

They do not own a ThinkPad. They do not own an IBM/Lenovo ThinkCentre desktop. They have a generic PC clone.

They do use Firefox.

The more commonly-available ones from Microsoft, APC, Targus, etc. do not, from the reading I've been doing, fluidly support Firefox password storage.

Microsoft's problem is probably willful ignorance or even outright tampering with the product so that it won't work with Firefox (DigitalPersona made the device for MS, and their older software for use with their U.are.U Personal scanner, which was pulled when Microsoft released theirs, reportedly works fine with Firefox). There is a Firefox extension that tries to make Firefox look like a different application to the MS-branded DigitalPersona software, but it appearently doesn't work 100% for everybody, and the authors are having to fight a moving target anyway (MS DigitalPersona 2.0 was recently released and conveniently 'broke' the extension).

APC et al. come bundled with Omnipass, but reports are that no APC scanner has ever been seen as shipped with Omnipass > v3.5, and 4.0 or later is required for Firefox support. No free upgrades are being given out by the vendors of these devices, and obtaining a copy of 4.0 from Softex (the software vendor) is decidedly a Not Free option.

But I digress.

I caught wind of IBM/Lenovo's own USB fingerprint scanner ($69.00 MSRP, 73P4774 for IBM logo, 41U3167 for Lenovo logo, otherwise the same device), and it looks like it may be the answer; despite all of the problems with CSS7 people have been reporting here, at the very least it sounds like it actually *comes* with a Firefox extension, and it also sounds like some people managed to find a workaround to make CSS6 work with Firefox as well.

I still have a few questions about this device, however:

1) Is Firefox 2.0 supported by the CSS7 Firefox extension, or only 1.5?
2) Can the IBM/Lenovo USB Fingerprint scanner work with ANY PC, or must it only be paired with one that has the ESS chip in it?

Question 2 is the one that concerns me the most: it seems to me that CSS, and not the Fingerprint software itself, is where the Password Manager feature that would save web passwords lies, and I thought that CSS would only work on/be able to be installed on a PC with the IBM security chip. Am I wrong? Should I expect the scanner and CSS software to work on any PC, and not just recent IBM PCs?

Also, are there other external fingerprint scanner solutions I am overlooking that someone could recommend to me?

I am much obliged!!

-- Nathan

[christopher_wolf]

1) Is Firefox 2.0 supported by the CSS7 Firefox extension, or only 1.5?
2) Can the IBM/Lenovo USB Fingerprint scanner work with ANY PC, or must it only be paired with one that has the ESS chip in it?

-- Nathan

It can be made to work with FF 2.0; there is a slight hack that must be made in one of the configuration files to change the version number from 1.5 to 2.0 to get the extension to work properly. I forget where the post was exactly, but it was in a CSS7 thread discussing how to get the extension to work with FF 2.0.

It should also work with any modern PC that has a USB 2.0 connector as I can't see any other requirements from it having to do with a specific ESS or TPM chip for it to work properly.

[NathanA]

christopher_wolf,

Thank you for your reply.

Unfortunately, I have some bad news for you and everyone else.

I ordered the fingerprint scanner, after seeing your reply here and being somewhat reassured as a result that it would work. I installed it on a non-IBM/Lenovo machine. The fingerprint software itself installed fine, and it works as far as logging into Windows is concerned, but CSS (ANY version) refuses to work (or even install in most cases) because of the lack of a TPM chip. As a result, I cannot use the fingerprint scanner in conjunction with the Password Manager feature, which is a part of CSS and *not* of the fingerprint software.

CSS 5.x and 7 both refused to install, saying that the machine is not supported (lack of TPM). I managed to "fake out" CSS6 during its install routine (I found it running some process called tpmdetect.exe or something to that effect, and just ended it when it started...installation happily went on its merry way), but once installed, only the Fingerprint Scanner and PrivateDisk options were available, and all of the other buttons on the CSS Control Center were grayed out, including Password Manager. In addition, I'd see an error every time I logged into the computer telling me about some CSS process that failed to start.

Just to make sure it wasn't some weird problem with the scanner itself, I installed it on my own T42p (which lacks the integrated scanner), and CSS installed and operated without a hitch (I had never used CSS or the TPM chip in my ThinkPad for anything prior to this).

Without CSS, the fingerprint scanner, when used apart from a recent IBM/Lenovo ThinkPad or ThinkCentre machine, is pretty much useless unless you are only concerned with using it as a substitute for a password when logging on to Windows. Without a Password Manager, the utility and value of the fingerprint scanner is greatly reduced.

See, this is what I was afraid was going to happen, and is why I posted the question(s) I did in the first place. Now I've just blown ~$70 only to find that this product doesn't meet my requirements, either. Crap.

Oh, don't worry, christopher_wolf...I don't fault you for this. I should have done more research than I did, and even contact Lenovo directly myself. I didn't. As a result, I got bit.

You'd think Lenovo could be bothered to release a simple password manager applet that could work in conjunction with the (external!) fingerprint scanner without requiring that it be run on a TCPA system, but nooooooo.

So, for future reference, if there is anyone else out there who was thinking about buying an IBM USB Fingerprint Scanner with the intent of using it in the same capacity as other major desktop fingerprint scanners on the market, don't bother; you'll find it to be a waste of valuable time and money (unless you own a Lenovo machine that contains the ESS TPM chip, that is).

*sigh* I guess I'll be crossing my fingers and picking up a Microsoft Fingerprint Reader tomorrow. Costs half of what the IBM one does @ $30 after rebate through the end of March, and works on all PCs universally. Ironic, that.

Sorry for my tiresome ranting,

-- Nathan

[lev]

I ordered the fingerprint scanner, after seeing your reply here and being somewhat reassured as a result that it would work. I installed it on a non-IBM/Lenovo machine. The fingerprint software itself installed fine, and it works as far as logging into Windows is concerned, but CSS (ANY version) refuses to work (or even install in most cases) because of the lack of a TPM chip. As a result, I cannot use the fingerprint scanner in conjunction with the Password Manager feature, which is a part of CSS and *not* of the fingerprint software.

You could try installing CSS with an extra switch to ask it to emulate a non-present TPM. You do this by using the commandline:
InstallFile.exe "/v EMULATIONMODE=1"
or
setup.exe /v"EMULATIONMODE=1"
or something like that. It's documented in the deployment guide (for CSS6 at least) but I didn't test it myself.

Hope that saves you from having to spend more money.... report back and let us know.

[NathanA]

Lev,

You're the man!

It had not crossed my mind to go digging through the ThinkVantage Deployment Guide, but sure enough, I grabbed copies of both the CSS6 and CSS7 versions, and they both talk about a software emulated TPM mode for running CSS (and thus the Password Manager) on machines that don't have the ESS chip!! Brilliant!

Only one itsy-bitsy problem remains. And that is that, although this option might work as advertised, the CSS7 install routine is still doing some kind of checking for something (probably machine ID in the BIOS) because even when specifying the EMULATIONMODE option to the installer, I get the following dialogue:

"This version of the Client Security Solution program can only be installed on select Lenovo computers. This setup cannot continue."

Now, obviously this is an arbitrary BS check put in the setup application in order to prevent people who have not purchased a Lenovo ThinkPad/ThinkCentre (and thus presumably do not have a license to run CSS on their computer) from installing the latest CSS7, and has nothing to do with the lack of a security chip.

Why do I say that? Well...

1) The CSS7 version of the ThinkVantage Deployment manual still mentions the EMULATIONMODE option, so it hasn't been removed in CSS7.

2) The EMULATIONMODE option worked perfectly fine for me when I tried to install CSS6 the same way!

Yes, that's right: I installed CSS6 this time without a hitch, and when I go to the "Audit security settings" section, it lists "Emulation" as the value for "Security Mode"! Also, Password Manager is working great, and also works fine in combination with the fingerprint scanner. After setting it to require a finger scan for a password recall, I tried saving a username/password combo for a web page in IE6, and then I hit Ctrl-F2 while on the page with the form, swiped my finger, and I was logged in. Swoosh!

CSS6 is great and all; however, it only works worth half-a-crap in Firefox (actually, any Mozilla-based brower since Seamonkey has the same problem...I tried Netscape 7.2 as well). When I try to set up a saved password for a web site in a Firefox window, I find that when I try to drag the little bullseye icon on top of the text field in the Firefox window I want it to fill in, it doesn't "recognize" that there is a text field there. Instead, it draws a red border around the whole Firefox window. This is probably because Firefox is not using standard Windows/MFC widgets/controls/what-have-you (Firefox paints the entire window by itself using its own custom controls). If one of the text fields has the focus when I bring up the Password Manager password creation window, then that field with the focus will get filled in if I drop the bullseye anywhere within the Firefox window. Using this technique, I can save the contents of only ONE field for an entire webpage form in a Firefox window, and furthermore that field MUST have the focus when I ask CSS to automatically fill in the form values for me, otherwise the wrong field will get filled in or nothing will get filled in (if no text field has focus at the time).

I could save the password and only the password this way with CSS6, but that's kind of a pain, because I'll have to fill in everything else manually and then make sure that the cursor ends up in the password field before I scan my finger for it to get filled in successfully. Also, requiring that I hit Ctrl-F2 to even fill in a form (even in IE) every single time is somewhat cumbersome as well. CSS7's approach to Firefox with the plug-in made specifically for it seems to me to be a much more sane approach to the problem.

However, I can't partake of CSS7 because Lenovo, in their infinite wisdom, decided to restrict installation of the version of CSS7 posted to their PC support site to "select Lenovo computers!" This is really sad, especially since, even though this fingerprint scanner is not destined to be paired with an IBM/Lenovo computer, I have a legitimate need to run CSS as well as a license to do so; after all, a copy of CSS (albeit old) was included in the same box with my fingerprint scanner!

Given the fact that Lev has made this breakthrough by discovering the TPM emulation feature in CSS, I think we're really close to cracking this case now. All that remains is to either find an alternative version of CSS7 that doesn't check to see what brand and model of computer it's being installed on (the ThinkVantage Deployment Guide makes mention of the fact that there are both regular and "OEM" versions of CSS, so I'm sure, esp. based on the mere existence of this "guide," that Lenovo intended to license CSS and other ThinkVantage software technologies to other OEMs, and I'm guessing that the version released to ThinkPad owners is an "OEM version" specifically for Lenovo computers), or to find a way to fool or completely bypass this check in the version I've already got.

Seems ridiculous that I have to go to all this trouble and jump through all of these hoops to use a product that I purchased in good faith to its full ability. Ah, well.

Anybody got any ideas?

Thanks again, everyone.

-- Nathan

[lev]

Lev,

You're the man!

I know...

Seems ridiculous that I have to go to all this trouble and jump through all of these hoops to use a product that I purchased in good faith to its full ability. Ah, well.

Anybody got any ideas?

Well, I've never made an mst before, and this is completely untested, but why don't you get the mst I made from here (only 3.5kb) http://pantheon.yale.edu/~lsb32/trans.mst and add it to the instalation line like this, along with the EMULATIONMODE stuff:

Code: Select all

z256zis1030us00.exe /V"TRANSFORMS=trans.mst EMULATIONMODE=1"

This should bypass the check for a lenovo bios and allow the installation to continue, I think. You should of course check whether this is consistent with your license agreement. And of course if there is some technical reason why (this version of) css can only run on a lenovo, say it makes use of proprietary bios interfaces, then who knows what might happen (ie, I hope you have recent backups). Anyway, if you're brave enough to test this let me know how you get on. Otherwise, it looks like you'll have to get hold of an OEM version of CSS, but I think lenovo only gives those out to big enterprise customers, who want to have the same software on all their machines, both their new purchase of 500 thinkpads, as well as their last year's purchase of 400 toshibas, so good luck....

[NathanA]

Well, I've never made an mst before, and this is completely untested, but...

...but nothing. It worked beautifully. Well done.

Again I must tip my hat to you, sir, for I have learned something new yet again from you. I was not that familiar with Windows Installer files, and didn't know you could real-time "patch" them in memory like that. After seeing this work for myself, I nabbed a copy of Orca and saw what it was that you did. Awesome...so simple.

I haven't actually tried CSS7 in conjunction with the fingerprint reader yet. I'll have time to do that this evening. In the meantime, I can confirm that simple passphrase authentication is working with CSS7, and that the Firefox plugin (mostly) works as expected with FF 2.0.0.1 (after modifying the XPI per instructions elsewhere on this forum).

The only weirdness I'm seeing right now with it is that for some reason, if I try to use the "Auto-submit" feature with a given Password Manager entry, it doesn't actually submit the form correctly in Firefox. Instead, it gets caught in an infinite loop of constantly reloading the page with the form on it. If I turn off auto-submit for that entry, it fills in the form correctly and I can submit it myself. Anyone else seeing this? Known bug? Possible side-effect of using a plug-in designed for FF1.5 with FF2?

Thanks again, man.

-- Nathan

[lev]

Again I must tip my hat to you, sir, for I have learned something new yet again from you. I was not that familiar with Windows Installer files, and didn't know you could real-time "patch" them in memory like that. After seeing this work for myself, I nabbed a copy of Orca and saw what it was that you did. Awesome...so simple.

I too was rather surprised at how simple it was to set it up. I'm glad that got it working for you.

The only weirdness I'm seeing right now with it is that for some reason, if I try to use the "Auto-submit" feature with a given Password Manager entry, it doesn't actually submit the form correctly in Firefox. Instead, it gets caught in an infinite loop of constantly reloading the page with the form on it. If I turn off auto-submit for that entry, it fills in the form correctly and I can submit it myself. Anyone else seeing this? Known bug? Possible side-effect of using a plug-in designed for FF1.5 with FF2?

Since I use neither CSS nor FF2, I can't help you with that one...

Thanks again, man.

No worries.