The Password Leaves the Screen

Lenovo, Intel, PayPal and Synaptics announced a collaboration to bring FIDO-enabled fingerprint authentication to PCs. The intended experience was straightforward: touch a laptop’s fingerprint reader to authenticate to a compatible online service such as PayPal, rather than type a password. Lenovo named the Yoga 910 convertible as the starting point for its laptops.

This was a promise about an integrated system, not evidence that passwords had been retired. The announcement supplies no independent security evaluation, adoption figures or measured reduction in fraud. Its ambition is worth examining without promoting the press release to a test report.

One touch, several dependencies

The proposed arrangement joined Synaptics’ Natural ID fingerprint sensing, seventh-generation Intel Core processors with Software Guard Extensions, Lenovo’s PC design and PayPal’s authentication ecosystem. FIDO standards supplied the common framework for authentication.

Lenovo described hardware protection for biometric information and FIDO credentials, saying the design kept both on the device. It also cited encryption and anti-spoofing features. Those are the companies’ descriptions of their protections, not independently demonstrated guarantees. The same release says manufacturers can choose among SentryPoint features; a catalogue of available defenses should not be mistaken for confirmation that every device implements every one.

The useful idea is nevertheless more substantial than putting a fingerprint icon on a login screen. In the announced design, the person’s touch would connect a local biometric check to authentication at a participating service. The website still needed to support the arrangement. A reader alone could not deliver the promised online experience.

That dependency is the story. The visible act becomes smaller because the coordination behind it becomes larger. “Passwordless” describes what the user need not type; it does not describe a system without things to trust.

Friction is not the only test

Reducing the burden of remembering account passwords is a worthwhile aim. Security that people can actually use is not a cosmetic improvement. Credit where due: the companies were addressing a practical problem, and using a shared standard rather than presenting a sensor as the entire solution.

But ease is only one dimension of control. The announcement does not explain the full recovery experience when a laptop is lost, how an unsuccessful fingerprint check is handled, or what alternatives a person can use. Those omissions do not establish that recovery or accessibility is broken. They establish that the release cannot settle those questions.

A coherenceist test would follow the person through those less photogenic moments. Can someone understand which account they are authorizing? Can they decline the biometric route? Can they regain access without surrendering to an opaque exception process? These are standards by which to judge an implementation, not features confirmed here.

Keeping sensitive authentication material on a device, as Lenovo described, is a meaningful design commitment. It is not the same commitment as making that device replaceable without stranding its owner. Both deserve scrutiny.

The September 2016 announcement captures a genuine engineering ambition: make several systems cooperate so a person has less work to do. Whether that cooperation serves the person depends on more than how cleanly the successful login disappears.

The demo ends when the fingertip works. The support queue starts when it doesn’t.