Security At The Touch Of A Finger

Consumers can use their fingerprints as a master password

I have been interested in fingerprint readers as security tools for a long time, but I've been reluctant to recommend them because they were expensive, complicated, and not terribly reliable. That has changed. There's a new generation of low-cost, simple readers on the market that can make computing easier, more secure, or both.

Fingerprint scanners range from optical readers that you use by placing a finger on a window, to "swipe readers," which are built into laptops, handhelds, and even USB memory keys. You use these by running your finger across a bar-like sensor. The optical readers are the simplest, but even the fussier swipe readers rarely misread your finger.

There are two basic uses for fingerprint readers. In corporations or government, they can be integrated with existing authentication systems to control access to the network, either as an alternative or as a supplement to passwords or other devices, such as smart cards. Of more interest to consumers, a fingerprint can be used as a sort of master password to log into your computer and Web sites, music services, and other things that need passwords.

A NEW LINE OF MICROSOFT FINGERPRINT readers for Windows XP, including a stand-alone USB scanner ($64, $84 bundled with a mouse) and a version built into a keyboard ($104), will push optical reader technology into the consumer mainstream. Oddly enough, the software tells you that the reader is intended to be used for convenience, not security -- a warning that I suspect will be heeded as much as the one on the Q-tips box that tells you not to stick swabs in your ears. When you start up your PC after installation, it invites you to register one or more fingers by touching the pad four times. After that, you log in simply by touching the pad. If the computer has more than one user, Windows checks the fingerprint to pick the right account. Once logged in, you can use the Password Manager software for additional log-ins. If, say, you want to visit Travelocity, you touch the fingerprint pad and the software automatically forwards your password to the Web site.

While Microsoft (MSFT ) is focusing on consumers and convenience, other vendors are looking at the corporate and government markets. Their systems typically tie into Windows Active Directory or other network access systems. Some IBM (IBM ) ThinkPad T42 models ($1,649 and up) have swipe readers built in just below the keyboard. Depending on the security settings, a fingerprint can be used, with or without a password, to boot the computer, gain access to the hard drive, and log in to Windows. It can also be used to supply passwords for Web sites.

You can get many of the same functions, at some sacrifice in convenience, from add-on units. DigitalPersona, the company behind Microsoft's products, offers a similar optical reader ($95) with different software that controls access to networks. The COMBO-Mini ($179) from Silex Technology America plugs into a USB port and adds a smart card to the fingerprint reader for extra security. The Silex reader had some trouble recognizing my fingerprint, but this was fixed when I turned down its sensitivity setting.

Probably the best way for individuals to use fingerprint readers is to pick strong passwords -- the sort someone else would have trouble guessing, but that you might have trouble remembering -- then use your fingerprint to pass them on to Web sites and other places that require them. It's a painless route to better security.

For a collection of past columns and online-only reviews of technology products, click here

By Stephen H. Wildstrom

Before it's here, it's on the Bloomberg Terminal.