Using KDE Connect for fingerprint auth?

Brainstorm
1

I am pretty sure I read this idea already, but its currently not implemented.

It would be great to use my phones fingerprint sensor to unlock the laptop. This would probably need

  • KDE connects already secure connection
  • Some way to send the polkit/sudo auth request to the app?
  • The app using the fingerprint sensor to generate some secret (it would need to store the password encrypted, unlockable with the fingerprint for example?)
  • OR a new Wayland portal to use an external sensor from KDE connect with fprintd

This sounds very complicated, but it would be great. I think sending the password directly would be best, does KDE Connect already use a newer TLS standard?

Also would improve KDE Connect usability for unlocking and at the same time you wouldn’t need a fingerprint sensor, which is not always supported or available, and USB Fingerprint sensors are extremely weird, not well documented, have the wrong description or are not available anymore like this one

What do you think? It would require some changes, but what exactly? I think having this authentication method would be great, maybe also for things like using the phone as an additional factor.

3 Likes
2

Hi Keening,

I think it is a good idea.

You can achieve this partially with the ‘Run Commands’ feature - On laptop side add command ‘loginctl unlock-session’. On the mobile side you might be able to add a shortcut depending on version of KDE connect/android/ios.

But it would be great if it were made more usable - with a dialog popping up on phone whenever unlock is triggered or for sudo operations etc.

Incidentally I got a USB fingerprint scanner to work on KDE Neon (“AUTHENTREND ATKey.Pro”) - they actually provide instructions for Linux on website - though is indeed a bit fiddly.

3

Additional, good idea, would be allow to read position form KDE Connect (Cell Phone) using GPS.

4

So this would allow using your phone as WiFi and GPS device, AND also fingerprint sensor and remote?

Damn that would be great.

What about mic and camera, remotely? This is already working with other solutions, latency and ease of setup just need to improve. Its not a KDE invention, more like Apple using something already there and selling it as a huuge innovation. But its so nieche while sh itty webcams and extremely overkill phone cameras are a daily problem.

5

WOW! This would be awesome indeed! I miss my fingerprint sensor (which sadly does not work under Linux…)

using my phone would be very, very handy!

I would add: “KDE Connect has the be able to connect via Mobile Data” to the list of requirements…

6

what does the last one mean? “Connect via mobile data” ? This means Bluetooth right, so its already covered. You cant connect devices over cell data afaik.

7

This means: KDE Connect stays connected to my cell phone as long as both have a working internet connection - regardless of which networks they use to connect to the internet.

This is how “My Phone” on Windows works.

I find it fairly limiting only to be able to use KDE Connect when my laptop and cell phone are on the same WiFi Network…

Bluetooth? Can I use KDE Connect using Bluetooth? How?

8

No you cant use KDE Connect via bluetooth. This windows my phone thing will be spying on you then, lol, as it will be cloud based. You cant talk to other devices on the same cell tower or whatever. KDE Connect works locally via Wifi, but could use bluetooth to be completely network independend

9

hmm .. I would not support Bluetooth connection to be used for sending authorization between laptops or desktops with KDE connect – bluetooth traffic, though encrypted, can be hacked and has already been hacked.

Now to think that my fingerprint or authorization to be sent to my laptop – you are setting something in motion, that will let malicious people to not only hack into your laptop, but also into your phone.

Moreover, using mobile data to authorize is a bad idea – think about how many hops or network nodes it will go through, before getting to your laptop or mobile phone – more data you keep out there, more info hackers can have to crack the encyption.

Please look into PQC – many vendors are working towards it, however, none of them have made any notable headway.

10

You don’t need secure transport to do secure authentication.

11

Current IT standards and zero trust will disagree with you. A design like that would be weak and prone to attacks and theaft.

12

Really? You don’t assume your connection to your bank account is safe because the wifi, ethernet … from your PC all the way to the bank server is “secure”, do you? A design like that would be weak and prone to attacks and theft. End-to-end encryption works. Requiring each hop to be secure doesn’t.

13

Yes, it is secure for now. This is exactly why I stated in my previous comment about PQC.

With the price of storage very low, one could store (targetted) all the internet traffic and decrypt it when QC is available for them to decrypt it.

14

apparently usage via bluetooth works kind of, never got it working though

also I see that the initial post is pretty confusing and mixed up.

The idea is storing the password encrypted in the Android StrongBox or at least KeyStore and unlocking it with the fingerprint, that is typical Android behavior. KeepassDX does something different for unlocking the database password. The password would then be sent as input over the network to the receiving device.

So basically a shortcut for entering a specific set of keyboard strokes.

If the device could tell the phone when a password prompt appears, so that the phone then shows the fingerprint dialog, that would round up the UX.

other features like sharing sensors or other data are pretty off topic for that