Wanted: Single Signon For My Windows-based Laptop

[tinjaw]

I understand that this increases the security risk, however, I willing to take tradeoff for the convenience.

While using my laptop I have multiple things I need to login to. A few of them are:

• Initial Windows XP login
• Login after I lock it (Win + L) or screensaver
• Firefox
• Thunderbird
• RoboForm

Here is my dream scenario. (My current laptop doesn't have bluetooth, so I would use a USB adapter for this.)

I wear my cellphone on my belt. The laptop senses my cellphone and prompts me for a password. As long as it keeps the connection with my cellphone the screensaver doesn't kick in. When the connection is broke, for example when I go to fill up my coffee cup, the screensaver kicks in and locks the computer. When I return it prompts for a password.

Every application that requires a password is automatically detected by the application and answered so I never need to enter in a password other than the master password.

There would be the usual override with a more complex password that would allow me to unlock the computer if I do not have my cellphone with me.

This is definitely possible today from the technology standpoint, but has a vendor refined a product well enough to actually do this and do it well?

[Ralf Maximus]

Shoot, dude, I can't keep bluetooth connections solid even when I'm sitting here next to the antenna.  The signal strength bounces up and down and disconnects/reconnects almost at random.  I experimented for a time with a bluetooth wireless headset, thinking it would be a better solution than the wired mic I was using at the time... I ditched it after three days.

It could be that my office is an especially noisy RF environment -- I wouldn't be surprised.  There's enough equipment packed in here that it's always the warmest room in da house.  :-)

Here's a thought: pick up one of those cheap RFID experimenter's kits and stick a chip in your wallet.  From what I understand the implementation is blindingly easy, as it's a simple "there/not there" kind of detection, instead of negotiating link speeds & transmitting data.  The computer senses the chip via its RFID antenna, reports the RFID number via an API, and proximity would be easy to detect.

Plus, you get to play with some cool new technology and learn skills towards the goal of conquoring the world.

As to the password part, mmmmaybe there's a way to tie it all together with a biometrics security module?  I know this isn't strictly a biometrics application, but much of the requirements are the same: store a password and when the user *does something* fire off the password.  The *does something* is usually a fingerprint or voiceprint, but it could just as easily be a card-swipe or (ahem) input from an RFID.  There are quite a few biometrics security packages out there, mostly having to do with Windows login, but I imagine the ones with an SDK would lend themselves to experimentation.

Now I am intrigued... off to do some googling!

UPDATE: Found a few things that may be relevant.

Two open source "password safe" applications that say they store passwords for most major apps, and can be trained.  One is standalone, and can be run from a USB key:

http://keepass.info/index.html
http://passwordsafe.sourceforge.net/

Secondly, here's a link to the RFID experimenter's kit I was thinking of:

http://www.trossenro...ys-Set.aspx?af=ag734

However, it's more expensive than I remembered, $99.  Ouch.  And because it's got a big goofy antenna mounted to an external pcb dangling from the end of a USB cable, it wouldn't be a very elegant laptop solution.

I've been rethinking the bluetooth thing... perhaps for your app simply detecting the device would be enough.  I don't know anything about bluetooth APIs but the motorola apps I played with treated the thing like a serial modem, with all the overhead of negotiating a signal, detecting baud rate, etc.  Maybe there's a simple "is twinned bluetooth device around?" kind of alternative mechanism?  I have no idea.

But if you get a password-safe solution working, then all you'd have to do is write a small tray applet that monitors for your bluetooth/whatever event, and when it detects the event, either:

1. Activate the Windows "lock desktop" feature (or even "activate screensaver" and password-protect that);

2. If the desktop's locked, send CTRL-ALT-DEL to the desktop, look for the "enter password" window class/title/handle of the password-saver dialog and jam the master password in there.

BTW, I asked on your behalf, and Rube Goldberg says he's *not* helping with this project.

[jgpaiva]

Here's a funny idea, similar to what you're asking. Disclaimer: i haven't tried it.

You probably won't find anything that will input every single password for you, it'd require something like a keyring at the OS level, something that only exists in mac OS and linux, afaik. regarding the windows login, i think i know the best next thing:
Buy a fingerprint reader so that you can login fast, and get used to pressing windows+L, to block the computer when you're gone. (or remmap it to windows+space with ahk, like i've done, and it's really really fast to press)