How secure are fingerprint readers vs password?

I use a very long and secure system password. I have never used fingerprint scanners except on phone. How does it compare to a 12-16 character complex password?

Don’t you still need a password, even if you have fingerprint login enabled? So by definition, having a fingerprint login only increases the attack surface of your device.

On the issue of whether the fingerprint sensor is just as “secure” from a hacking perspective…my stance is that it doesn’t matter. Even if the sensor were 1000x more difficult to hack remotely, it’s still vastly easier (and more likely) to be circumvented by just coercing you to use your own finger (whether by force or law). A password on the other hand is in your head, which is harder to force - imo.

My stance is that biometrics are for convenience, not security.

Flaws in Fingerprint Sensors (Nov. 2023) says:

A new research has uncovered multiple vulnerabilities that could be exploited to bypass Windows Hello authentication on Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops.

Thanks and valid points which I agree with, but kind of not what I was after. I mean technically-speaking. Forget being forced to give fingerprint/password. If a machine was stolen from my car, just for argument’s sake, would it be safer with a decent complex password or with fingerprint when it comes to getting into it. I would assume password is MUCH more secure, but wondered if I am wrong there. I am interested in which is the more secure technically to brute force/hack, not including social engineering and other (possible) exploits.

Thanks, I’ve never heard of Windows Hello. Would this information apply to a fingerprint reader being used on, say, Fedora?

If the fingerprint driver depends on some binary blob it may well have the same implementation mistakes as the Windows driver. At my work, fingerprint readers were dropped, and password requirements were changed to a minimum length with a recommendation that we use a line from a song or poem. The requirement for frequent password changes was also relaxed. All that may have changed in the 5 years since I retired.

[edit]: From the ARS Technica article:

The Dell laptop’s Goodix fingerprint sensor implemented SDCP properly in Windows but used no such protections in Linux.

1 Like

Interesting. thanks
I have never used nor wanted a fingerprint on a laptop, but I see some have the option and some don’t, so I was wondering if it ‘adds’ anything to the mix, and I guess it doesn’t (except attack surface perhaps :D) I’ll stick to my memorised complex password

You can change a password/passphrase, and you can refuse to give them.

Biometrics (like fingerprints, photos, etc.) can be duplicated / lifted without your consent or knowledge, and they cannot be replaced.

You keep missing my point. I did try to explain. Let me try again:

A thief steals my laptop. They do not have my password. They do not have my fingerprint. They do not have my photo. They have NO WAY to get/force/steal/otherwise obtain the necessary credentials for either password or fingerprint.

I am asking which would be easier to hack into through, password or fingerprint sensor?

There is no “this or that” answer to such a question. For properly set password (a passphrase, long enough, containing symbols/punctuation marks, lower and upper case letter) is always stronger then a finger print alone. But if the password is passw123, then it’s about the same as fingerprint to crack/obtain.
That’s simplified, but still can give you idea about how quickly passwords can be cracked depending on password length and complexity

Er, thank you!

“There is no “this or that” answer to such a question.”

“properly set password is always stronger then a finger print alone.”

you did just answer the question, perfectly! thank you!

(Ps I explained above how complex my password is. So it’s stronger than a fingerprint alone. Boom, there’s my answer. thanks again)

Yes, and adding the fingerprint adds to the required steps to hack the machine so it adds to the security, but should not be an absolute replacement in every situation.

1 Like

aaah. I assumed it was either or. If the fingerprint can unlock the machine when in standby, i guess it’s a bigger risk compared to password. That’s useful to know thanks

1 Like

Both login password and fingerprint are trivial to bypass by booting a different system from a USB media or by extracting the disk and attaching it to a different machine.

Full physical access to the machine nullifies any protection other than disk/data encryption.

1 Like