New CSS 7 (Client Security Solution) Posted July 19, 2006

[Tony's X60s]

My intermittent problem (an inescapable loop, almost always after resuming from suspend conditon, cycling through two error messages "you don't have a fingerprint enrolled" and "you don't have a password configured" which required that I hold the power button down to reset the computer - and which occurred about every 2-3 days) finally developed into a hard fault - CSS refused to accept any form of user authentication (fingerprint or password) and refused to enroll me as a user. However, this did not stop me from using Windows and even my SecureDrive on which all the sensitive work stuff is stored.

I called IBM support and got "no one else is reporting any problems with CSS7" and "until you restore it to factory image, we can't help you". Interestingly, I also got "we'll have to load it onto a Thinkpad here to try and replicate the problem". Estimating their requirements would involve about 1-2 days serious (I mean risky) effort since I have the normal apps inventory installed, I asked them to escalate the call. They said they would do so, but this would not get it to a CSS product expert just to a hardware expert.

I thought about it and then -
- shifted the contents of my main secure drive to an unencrypted folder
- cleared the security chip, set it to inactive and uninstalled CSS7.

Oh joy! Everything again works like I dreamed. The fingerprint reader always reacts quickly and gives me feedback if I don't swipe properly. What I thought were problems associated with EMF interference with the fp reader have disappeared.

CSS7 is a truly flakey piece of software. I dearly love the concept and am really disappointed that the execution is so bad.

[Prince]

I called IBM support and got "no one else is reporting any problems with CSS7" and "until you restore it to factory image, we can't help you". Interestingly, I also got "we'll have to load it onto a Thinkpad here to try and replicate the problem". Estimating their requirements would involve about 1-2 days serious (I mean risky) effort since I have the normal apps inventory installed, I asked them to escalate the call. They said they would do so, but this would not get it to a CSS product expert just to a hardware expert.

IBM have the best costumer support??? take a look at what i received from them 16 days after i submited an online request and provided all the data they claimed they didn't have(you can't post it if you don't provide that info):

Dear Sir/Madam,

IBM/Lenovo provides free software support for the first 30 days after the purchase of the machine.

Unfortunately, we have been unable to verify your support entitlement. This could be because you have either not included your computers type, model and serial number in your support request, or that it is more then 30 days since the computer was manufactured.

Since we can not determine which country you are in, please see the following weblink to find contact details for your local IBM support who might be able to help you:
http://www.ibm.com/planetwide/

Thank you for using IBM Electronic Support and Services.

Mikael Sandstrom
IBM Worldwide Electronic Support and Services


IBM Personal Computing Division
http://www.ibm.com/pc/support

no surpise that nobody have problem with CSS 7!!!!

[Tony's X60s]

I'm happy to report that without CSS7, my X60s Thinkpad experience is near perfect. The biggest surprise is that the fingerprint reader now has no problems at all - so all that stuff about EMF interference was really CSS7 problems. I'm never going back.

[Nick Y]

I'm happy to report that without CSS7, my X60s Thinkpad experience is near perfect. The biggest surprise is that the fingerprint reader now has no problems at all - so all that stuff about EMF interference was really CSS7 problems. I'm never going back.

Did you notice that there is some design/implementation difference between CSS7 login and the PM use of fingerprints? Login, with its somewhat bland dialog box, always gives me problems; takes several finger-swipes and is not because other processes are running. Using PM to give access to somewhere brings up the finger-icon swipe and that always works first time. Strange as I would have thought that they would use the same implementation.

I think that I may well follow your lead and simply remove CSS7, yet again, once I have recorded my passwords, etc.

[jamess]

I'm happy to report that without CSS7, my X60s Thinkpad experience is near perfect. The biggest surprise is that the fingerprint reader now has no problems at all - so all that stuff about EMF interference was really CSS7 problems. I'm never going back.

I am thinking of removing my CSS 7....017 as well instead of even upgrading to 022. When i got my x60s it worked much faster w/password entries etc - i had CSS 6.

If i only remove CSS will I still be able to use FingerP.Reader for loggin onto windows and password manager for websites? If i understand - all that i'll lose removing CSS 7.0 is:
- chip deactivated
- no secure drive

Thanks for your answer (I just hate it because "waking" from stand by now takes about 30 sec instead of about 4 as it did before i had CSS installed.).

Can i simply remove it by Start - Control Panel - ADd/Remove programs or is it better to use Thinkvantage update/installer (uninstaller) ? Which is "safer" ?

Cheers

[Uncletoad]

I dumped it as well. Just uninstalled from add/remove programs and from a cold boot pressed F1 went to security and reset and turned off the chip.

Maybe they'll fix this stuff and make it usable in the future.

I'm annoyed at the trashing of something I bought my system for in the first place.

Fingerprints do work for windows without CSS6 or 7.

[jamess]

Does it make sense to de-activate the chip prior to removing/uninstalling CSS or simply remove, and turn off, press F1 and turn it off in Bios?

[Uncletoad]

Does it make sense to de-activate the chip prior to removing/uninstalling CSS or simply remove, and turn off, press F1 and turn it off in Bios?

I dunno. I uninstalled the software then turned the computer completely off. Then I restarted it, pressed F1 and when in bios I reset the chip and disabled it.

No problems.

[jamess]

Thanks, will uninstall shortly and let you know of the outcome

EDIT: Successfuly uninstalled and deactivated. Boot time 1min 25 sec instead of about 2:20.

And it resumes from stand by as it should - about 3 sec. Also the FPReader is super effective (responsive) now.

I am glad i uninstalled CSS 7.0.

Cheers

[Nick Y]

This T43 is now a CSS-free zone. Perhaps I will try again when CSS8 comes out, or perhaps 9...

[turkington]

I'm finally having good success with CSS7 but after a lot of messing around (forget the documetation). I have no problems autheticating to websites, but I was having a really frustrating problem with Outlook.

I use XP SP2 and Office 2003 on my T60... Outlook is configred to connect to several Exchange servers (different organizations) using RPC/HTTP as I'm not always on the respective LANs.

When I invoke Outlook, it asks me for a profile and once selected, I get the outlook authentication dialog... So far so good - I enter the credentials and CSS asks me if I would like to save this. I do and the first one works great.

I exit Outlook and try to do the same thing all over again for the second Exchange site... this is where the CSS weirdness starts... Instead of giving me a autentication dialog, CSS trys to auto-submit the previous information! To make a long story short, you can't auto-submit as CSS doesn't know which site intially... you need to wait for the autentication dialog and then press CTRL/F2 to enter the info.

Ok, so that done, both profiles in Outlook are configured and have associated pairs of entries in CSS. Works great! Then I start noticing that it doesn't always work (press CTRL/F2 and nothing happens...)

To make another long story short, it seems that CSS looks at both the URL _and_ the program invoked to select an entry... For some reason the shortcut on my quick launch bar was the full NTFS path (C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE) and the one in my start menu was the 8.3 variant (C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE) and CSS saw these as different.

Duplicating entries for each with full and 8.3 paths, and associating one with the other so that passwords change together makes this work.

Hope that helps someone else.

[truthiness]

fyi, I did the upgrade yesterday to CSS7 and am not having any of the described issues on a brand new z60m.

The interesting thing is that once I removed CSS6 I then ran the System Update again and there was a whole list of new updates, almost 850Mb worth. I went ahead and downloaded/installed CSS7, and then downloaded and installed all of the updates and things seem to be working smoothly.

I just am mentioning this because I don't see anyone mentioning this new list of updates after their install of CSS7, and maybe this is why people are having issues if these updates are not installed?

[Uncletoad]

The interesting thing is that once I removed CSS6 I then ran the System Update again and there was a whole list of new updates, almost 850Mb worth. I went ahead and downloaded/installed CSS7, and then downloaded and installed all of the updates and things seem to be working smoothly.

Updates for what? CSS7?

[truthiness]

The interesting thing is that once I removed CSS6 I then ran the System Update again and there was a whole list of new updates, almost 850Mb worth. I went ahead and downloaded/installed CSS7, and then downloaded and installed all of the updates and things seem to be working smoothly.

Updates for what? CSS7?

sorry about that...

they were updates for all of the other ThinkVantage components. Almost as if they needed to be updated to work with CSS7.

I had run the update program prior to any upgrade to CSS7, so as far as I could tell, my system was completely upgraded prior to me unininstalling CSS6. After uninstalling CSS6, I ran the upgrade program, and the updater knew that I needed to upgrade to CSS7, but it also provided a list of updates to the whole suite of products.

I'm a TP newcomer, so maybe this is SOP (standard operating procedure), but it seemed to make sense that the system would be laggy with CSS7 if these other updates were not installed.

But I'm currently on CSS7 and FP reader is very snappy and all other TVantage apps seem to be functioning properly and within acceptable load times, etc.