A few days ago I’ve managed to stumble across another problem with using fingerprint authentication on my X61 Tablet. The screenshot below summarizes it the best.

If you run any command that asks you for your password over SSH, then it will ask you to swipe your finger. This is a problem because if you are SSH’ing into your computer, then it most likely means that you are not physically present and so you cannot swipe your finger. The good news is that you don’t have to swipe your finger to actually login via SSH, so this isn’t as big of a problem. Only if you plan to use the sudo or su commands.

So what is the solution? I don’t think there is a good one. I did come up with a proposal for one, but it is not perfect since it doesn’t even work yet with my driver of choice (fprint). The best solution would be for the fingerprint driver to guess if it is being called from a remote machine or local machine, and fail based on that. However that is not possible yet. What I would propose instead is to prompt a user for a fingerprint, allow him to cancel it via a keyboard and then prompt him for a password.

This might not seem like a very good solution, since maybe you want your computer to be very secure and always want a biological identification. Asking for a password then defeats the purpose. If this is what you want, then I suggest you watch this video. Fingerprints readers aren’t very secure and can be bypassed. I think the purpose of having a fingerprint reader is to provide a balance between security and practicality. Swiping a finger is much faster and easier than typing a long password. This is especially true when you are using a tablet and do not have access to a keyboard. And it is relatively secure, since an average person would not probably be able to bypass it. It does require a bit of work and equipment.

Before I begin, I will go over how the fingerprint drivers plug into the standard Linux authentication framework, PAM. This background information is not very throughout, since I have just learned it myself this morning. But it should give you enough knowledge to understand why this fingerprint problem is present and maybe to come up with alternate solutions. Please leave a comment if you do.

When a program wants to authenticate a user, it talks to PAM. PAM asks the program for a username and what service to authenticate for. The reason it asks for a service is that different services might have different rules for authentication. The rules for the service are stored in the file /etc/pam.d/service-name, where service-name is the name of the service. This file contains a list of rules, one rule per line. Comments start with the # symbol and are included. Each rule has the following syntax:

type control module

The type field is the type of the rule. There are different types. For example, the auth type is used to authenticate a user by prompting him for a password. The control field determines what action should be taken if the rule fails or succeeds. For example, a required control means that the rule must succeed for the user to be authenticated. On the other had, a suffiecient control means that if the rule succeed then the user is authenticated and if it fails, then the other rules will be tested. The module field is just a reference to which module will be used to test the rule. The pam.d manpage contains a list of possible values for the type and control fields.

PAM starts by evaluating the rules in order. If the first rule tells it that the user is authenticated, then it finishes. If the first rule tells it that the user is not authenticated, then it proceeds to the next rule (or finishes) based on the value stored in the control field. A quirk is that a required rule is not always tested. For example, if the first rule is sufficient, then the user is authenticated whether any consequent required rules would fail or succeed.

If you followed my tutorial (or one of the many countless tutorials on the web) to setup your finger print reader, then you added the following set of lines to the file /etc/pam.d/common-auth. This file is the set of rules that is included in almost every service defined in the same directory.

auth sufficient pam_fprint.so
auth required pam_unix.so nullok_secure

This means that PAM first asks for a fingerprint. If that fails (wrong finger, reader not present or hardware error…), then the first rule fails. Since the rule is only sufficient, then PAM proceeds to the next rule. The next rule is the rule for standard Unix password authentication. What I would like fprint to do is to fail (causing it to proceed to password prompt) if I hit a certain key. For example according to the ThinkWiki page, the properiaty bio_api driver already does this with the Ctrl+C key combination. This way I could choose whether to use a fingerprint or proceed with typing in a password.

Of course, some people you use the keyboard more than the fingerprint reader. In that case, you can replace those two lines with the following.

auth sufficient pam_unix.so nullok_secure
auth required pam_fprint.so

This means “try password first, then fingerprint”. You can always cause the password prompt to fail by hitting Ctrl+C.

Merry Christmas, and an even more merry Boxing Day tomorrow! But most importantly, take some time to remember that today (in Julian Calendar) is the birthday of a man without whom we wouldn’t have the world as we know it today.

[Image Source: Wikipedia]

This is part two of the tutorial on installing iPhone OS 3.0 on an iPod Touch 2G using Linux and VirtualBox. In the previous tutorial, I described how to upgrade the firmware on the iPod using Apple’s iTunes application. This was a necessary step in jailbreaking the device, so make sure to follow it before starting this tutorial. I will assume that you did…

Note that there is also a reason why I did not include the iPhone in the title of this post. iPod Touch is jailbroken using redsn0w, which I understand is different from the application used to jailbreak an iPhone. Since I do not have an iPhone to test with, you are on your own.  So to reiterate, this tutorial only works with iPod Touch 2G!

The Guide

1. Upgrade to iPhone OS 3.0
2. Connect your iPod to your computer via USB.
3. Fully shut off your iPod. This can be done by holding the power button and waiting until the message “Slide to power off” appears. Then slide the slider to turn off the iPod.
4. Download the latest RedSn0w, for which a link can always be found in the iPod Touch Fans forum or downloaded from the Pirate Bay. As of writing this post, RedSn0w is at version 0.72
5. Unpack the downloaded ZIP file on your desktop and go into the extracted folder.
6. Double click the redn0w.exe file to start the jailbreaking program.
7. Click on the “Browse” button and find the 3.0 firmware package. It should be in the folder C:\Users\%USER%\AppData\Roaming\Apple Computer\iTunes\iPod Software Updates
8. Wait for RedSn0w to load the package. After it is done, the window should say “IPSW successfully identified” and the next button should be enabled.
9. Click the next button and wait for RedSn0w to download some data and patch the package.
10. In the next page, make sure that Install Cydia is checked and Install Icy is NOT checked. Both Cydia and Icy are two very great applications that install jailbroken applications on your iPod, but RedSn0w 0.72 has a bug due to which installing both will result in both of them not working. It is recommended that you only install Cydia and use it to install the latest Icy.
11. Click next to continue.
12. Read the text (aka make sure your iPod is turned off and connected) and click next.
13. In the next page, you will get the instructions on how to put your iPod into DFU mode. Read and follow them. To summarize, you hold the power button for 3 seconds, then without releasing it, press the home button until the iPod screen turns black. Let go of the power button, but keep holding the home button. After you are in DFU mode, RedSn0w will continue.
14. RedSn0w will start the jailbreaking process, but stop at “Waiting for reboot“. Don’t bother waiting, because that message will never change. What you have to do is right click on the USB Devices icon in the lower right corner of the VirtualBox window and click on the entry for your iPod. This will force VirtualBox to unregister the iPod and RedSn0w will automatically proceed with the jailbreak. VirtualBox might print out some error, but you can ignore it.
15. Wait for a few minutes…. In the meantime, your iPod will display the message “Downloading Jailbreak Data…”.
16. Hit Finish. The rest of the jailbreak will happen on the iPod and so you can safely unplug the device and turn off VirtualBox.
17. Enjoy your jailbroken iPod!

Well, at least the boulder is made out of lego…

A short while ago PhyOrg run a story on the cost of popcorn in movie cinemas and the reason for the high price as given in a study by Wesley Hartmann Ricard Gil. After examining the revenue data of many theaters, they concluded the high concession prices are due to the fact that they allow cheaper ticket prices. The logic for it is as follows: since there are many “diehard moviegoers” who are willing to pay $5-$10 for a small bag of popcorn no matter what, the theaters can use this profit to “pay for” a portion of the ticket of the average person. This means that a wider audience will afford to go see a movie, which in turn results in even more revenue from advertisers and so on.

Seeing this study from the perspective of a consumer, it changes my opinion of the cinemas. Now I know they are not trying to create some kind of a concession monopoly on their premises, but instead they want to allow me to see more movies for a lower price. Since I do not purchase any food in the theatre anyways, I see it as a good thing.

How about you? Would you rather pay $10 for a ticket and $5 for popcorn or $15 for a ticket and a few cents for popcorn?

The winter holiday is over and PSP game developers are starting to get back to work. This week there will be one game released, Harvey Birdman: Attorney at Law. This might be a great game for comic book fans. Also there have also been many more homebrew releases in the last week, which I will blog about later.

Harvey Birdman: Attorney at Law
Release Date: January 8, 2008
Genre: Adventure
Harvey Birdman Attorney at Law is primarily an interactive story that the player participates in, rather than a challenge-based game that needs to be won. Each case is a self-contained story, incorporating the characters, settings, and most importantly, the off-beat humor that Harvey Birdman fans have come to expect.

Over the course of the game, players must guide Harvey through a series of odd and comical cases. In order to prove his client’s innocence, Harvey must explore the scene of the crime, gather evidence, talk with other cartoon characters, occasionally have drinks with opposing council, and of course, tear holes — no matter how ridiculous — in the testimony provided by the witnesses for the prosecution.

On Boxing Day I blogged about the saving that Best Buy had on 4GB Sony Pro Duo memory sticks for your PSP. However that deal was only restricted to Canada, so those of you in other countries couldn’t get it. But not Frys.com has an even better deal, and they ship internationally! For $35 (plus shipping and other fees), you can get a 4GB PLATINUM II LEXAR Pro Duo Memory Stick that should fit into your PSP.

I finally got a Twitter account! You can find my profile at kkrizka, so add me. I will look for a desktop twitter client tomorrow, but it would be great if there was one with the interface similar to gnome-blog. That way I can just drop down the dialogue, and update my status quickly.

Earlier today I blogged about how Rhythmbox claims that it supports PlayStation Portables. Well, I got to try it out when I got home, and this is what I found out. After connecting my PSP to the computer via the USB cable, Rhythmbox popped up and in the devices section, I saw a “Sony PSP Media Player”. The next step was to drag & drop a song onto it and it started transferring it. I though great, and quickly disconnected the PSP. However there were no detected songs.

Perplexed, I tried to figure out what the problem was. So I connected the PSP back to the computer and started snooping around the memory stick. It turns out that Rhythmbox copied the songs into the folder MUSIC/PSP/MUSIC. But PSP only looks into the MUSIC folder or one more folder in. I am sure that this is only a small typo in the code, and I will investigate further tomorrow morning.

However I am happy to announce that Rhythmbox automatically transcoded the song into MP3, so I did not have to worry about getting the right file format.