Microsoft Fingerprint Reader

~ the obit ~

"The fingerprint reader is not a security feature and is intended to be used for convenience only." That line was published by Microsoft, in the online Getting Started manual for the Microsoft Fingerprint Reader, and it was sitting there in April 2006 underneath a product being advertised on the promise that your thumb could replace your passwords. Mouse Print, a site that existed to read the small type under advertising claims, found it and wrote it up on 15 April 2006. It was not a leak or an internal memo. It was the instruction booklet.

The hardware arrived on 8 September 2004, announced in a Microsoft press release that bundled it with eight other input devices. A small oval optical sensor on a USB cable, about the size of a domino, with a red glow under the window. It sold for $55 by itself, or came attached to a Wireless IntelliMouse Explorer for $85, or as part of an Optical Desktop package for $110. The biometric software underneath was not Microsoft's; it came from DigitalPersona, which had been building fingerprint authentication for enterprise customers for years and licensed a consumer version into a Microsoft box.

What it actually did was password management with a finger instead of a master password. You registered up to ten fingerprints. Your usernames and passwords were stored locally on the machine, mapped to a fingerprint, and when the sensor recognized a print the software typed the stored credential into whatever website or application you were looking at. Internet Explorer worked out of the box. Firefox users needed a third-party add-on called FingerFox, which is a detail that will tell anyone who was on the web in 2005 exactly what kind of product this was.

~ the rap sheet ~

~ the disclaimer ~

The reason the disclaimer existed is that the device was genuinely not secure, and Microsoft knew it. Researchers demonstrated in 2006 that the reader could be defeated, and the credential store it fed was never designed to resist an attacker with access to the machine. What the product delivered was the removal of typing, not the addition of protection. Anyone who read the box got the opposite impression, which is why a consumer-advocacy blog was the one that surfaced the sentence.

That tension is what makes the thing worth remembering. Fingerprint login on a personal computer was, in 2004, a demo rather than a security model, and the honest version of the pitch would have been that it saved you fifteen seconds. Windows Hello would eventually do this properly with a TPM and a secure enclave behind it, more than a decade later. The 2004 version was a webcam for your thumb with a text file behind it.

~ the quiet end ~

There is no shutdown announcement to point at, which is normal for peripherals and still faintly annoying. Microsoft stopped restocking it after Windows Vista shipped in early 2007 and never said anything. The drivers were built for 32-bit Windows XP and Vista, and no 64-bit version was ever released; owners on 64-bit machines traded modified driver packages on forums, and when Windows 7 arrived in 2009 the hardware was dead in every practical sense while still sitting on desks.

I was in Ankara finishing an engineering degree while this was on American shelves, and biometric login on a home PC was not a thing anyone I knew had opinions about. Turkey got fingerprint readers the way most of the world did: built into laptop palmrests a few years later, ignored by most people who owned one. The standalone USB version was always a specialty purchase in a specialty market, and it lasted about as long as specialty purchases usually do.

~ the sentence that outlived it ~

The product is forgotten and the disclaimer is not. It gets quoted whenever somebody argues about consumer biometrics, because it is a vendor stating plainly, in its own documentation, that the thing on the box does not do what the box says. Twenty years of fingerprint sensors on laptops and phones have since been built on top of hardware that genuinely can make that claim, and the 2004 version is the marker for where the line used to sit.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »