Which fingerprint scanner to take to authorize users on a PC?

Question

Scanners

I would like to implement user authorization on computers using biometric identification, namely a fingerprint. For example, an employee comes to office No. 1, sits down at the computer, puts his finger on the scanner and is authorized under his Active Directory account, and in the afternoon this employee wanted to work in office No. 2 at another computer and putting his finger on the scanner he entered under the same account as in the first cabinet.
So a number of questions arose:
1. Which one is better to use a fingerprint scanner? Is it possible to assemble it yourself and connect it to a PC via USB?
2. What algorithms are there to convert a fingerprint to a hash?
3. What can you say with your sober view of this undertaking?

Answer 1

You should be more interested in what protocols the active directory supports (and you did not announce the version of the deployed one), which ones the client computer and the desired reader support, how to issue / register new users, how to revoke the rights of previously issued ones, etc. and many different nuances.
For example, when compared with smart cards, you lose such a bonus as blocking the session when the smart card is removed, because it is difficult to imagine that someone will keep their finger on the reader during work.
And in general, fingerprints are another thing ... In theory, it will be necessary to collect permission from employees to process personal data, and much more related to this
than tokens / smart cards did not please? there are contactless
and don't forget to add "folder redirection" to roaming profiles

Answer 2

it is better to set a strong password

Answer 3

I would like to implement user authorization on computers using biometric identification ...

Who wants it?
Chief? Then buy expensive scanners.
To you? Then buy one to try.
In any case, the keyword "Roaming profile"

Answer 4

Fingerprints don't change much over the course of a lifetime, but for a fingerprint reader.
For scanners, especially for cheap ones, a dry and wet finger will already give false positives or vice versa.
Therefore, it is not recommended to save money on scanners, or always duplicate the ability to enter a password.

Answer 5

There are ready-made ones - eKey, but they need to enter several fingers (usually 2 - 3), because. they don't always recognize.

Answer 6

I bought one like this two years ago for 1300, now it’s already 2000 :(
At that time it was the cheapest on Alik. It started up perfectly in Windows 10, it worked well.
Please note that in order to use WIndows Hello in Active Directory, you need an Azure Active Directory subscription, without it won't fly.