Slashdot Log In
Typing Patterns for Authentication
Posted by
CowboyNeal
on Thu Apr 19, 2007 08:12 PM
from the no-one-touches-like-you dept.
from the no-one-touches-like-you dept.
Kelson writes "NPR's Marketplace is reporting on a new authentication scheme. BioPassword tracks the way you type your password: how long each key is depressed, the time between keystrokes, and overall speed. When someone tries to log into your account, it compares the pattern to what it has on file. It only allows you in if both the password and patterns match. The technique has been around a while. World War II Morse code operators used it to determine whether a message was sent by an ally or an impostor."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Fist (Score:5, Informative)
I think this is a pretty nifty idea, and I'm surprised it hasn't been done before.
Re:Fist (Score:5, Insightful)
Parent
Re:Fist (Score:5, Funny)
Man, I don't know about those circumstances, but I would welcome an online financial transaction system that's good enough to recognize whether or not I'm drunkenly typing in my credit card number after a night on the town. The combination of woot.com and a few too many beers has on more than one occasion proved fatal to both my self-respect and my checking account...as if two Roombas isn't enough as it is!
Parent
Re:Fist (Score:4, Funny)
Parent
Re:Fist (Score:4, Funny)
A few days later, a Palm Tungsten arrived at my place of work; and when my bank statement arrived, that turned out to have been the only purchase I had made during those lost hours. It could have been worse. A lot worse, judging by my the sites in my browser history!
Lesson: Don't order stuff online while pissed and/or stoned.
Parent
Re: (Score:3, Insightful)
Re:Fist (Score:5, Funny)
Parent
Sharing Secrets (Score:5, Funny)
Yeah, not only that, but imagine when you've forgotten something important and you call home to talk to your spouse to get it.
Parent
Re:Sharing Secrets (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
* No, I'm not speaking from experience.
Re: (Score:3, Insightful)
I can think of several people that could know the password after that telephone conversation, some of which the people having the conversation won't even know exist. One of many reasons to never share your password with anyone is that in the act of sharing it you expose it to potential (untrusted) snoopers, even if you trust the intended recipient.
Frankly, the whole argument w
Re: (Score:3, Informative)
Why the fuck would you marry someone you don't even trust?
Why the fuck would you divorce someone that agreed to take care of you when you're old?
Anyways, lots and lots of married couples keep things from each other, it's in no way misogynistic or stupid, it's actually natural. From this perspective I find the GP funny, as a man who's been divorced, I think of it more as informative than anything. And please save the big words for when you really need them, people are using the "m" word far too often these days.
Re: (Score:3, Informative)
...lots and lots of married couples keep things from each other, it's in no way misogynistic or stupid, it's actually natural.
It's called privacy, everyone needs it, it is in no way misogynistic.
The last-reported U.S. divorce rate for a calendar year, available as of May, 2005, is 0.38% divorces per capita per year, ...
The National Center for Health Statistics recently released a report which found that 43 percent of first marriages end in separation or divorce within 15 years.
http://www.divorcereform.org/rates.html [divorcereform.org]
Good luck! I don't know how long you've been married, but all things considered, I think I did alright. Anyways, thanks for busting my balls and if you ever need advice for your divorce, you can count me out. ;)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
+1 Clippy of awareness (Score:5, Funny)
while you were drunk, I intercepted the email you wrote to
- the girl from the office
would you like to read it again before it is sent?[No] [Ignore] [Cancel]
Parent
Re:Fist (Score:4, Interesting)
Once trained, it was extremely hard to fool the thing, even by deliberately and extremely altering your typing habits. Of course, this was a multiple choice test and that's easier than the authentication situation, but it shows that the method can be more robust than would first appear.
Parent
Re: (Score:2, Informative)
--Q
Re:Fist (Score:5, Funny)
It won't be long before online fraudsters learn to copy users "fists."
Yes, I predict the internet will be awash in "fisting" websites within the fortnight.
-Isaac
Parent
Typschrift (Score:3, Interesting)
Well, it has been done before. I graduated from the Academy of Arts in Rottterdam in 1996 with some fonts that changed their shape depending on how you typed. Inspiration fo these fonts was exactly this technique, which I had heard about, on some big IT show, at least 5 years before.
A JAVA version of one of the fonts (Typschrift-B [www.typ.nl], a rather crude version but my JAVA-knowledge is kind of non-existent) is the only thing that i
It has been done before. (Score:3, Interesting)
1977, Rome:
G. Forsen, M. Nelson, and R. Staron, "Personal Attributes Authentication Techniques," Rome Air Development Center Report RADC-TR-77-1033, Air Force Base Griffis (New York, 1977).
1980, Rand:
R. Gaines, W. Lisowski, S. Press, and N. Shapiro, "Authentication by Keystroke Timing: Some Preliminary Results," Technical Report Rand report R-256-NSF, Rand Corpora
Bad Idea (Score:5, Insightful)
Re: (Score:2)
RICHARDS: You're sleepy, right. They have a few little measures to catch that. If after a couple of goes it seems you're not typing the way it expects you to type, it will ask some additional security questions. (Emphasis mine)
Re: (Score:3, Insightful)
The problem with that is remembering all the different answers.
To be honest, I don't see a good solution to the problem that people are required to remember more and more passwords. I would think that most people either pick the same passwords for most things, or store the p
Re:Bad Idea (Score:5, Funny)
One day the letter arrives. It is in Blue ink. it raves about the luxury goods, and the stores of plenty. In fact says the writer, the only thing in short supply seems to be red ink.
The modern version would have the comrade unable to log in because all the keyboards were dvorak.
Parent
Re:Bad Idea (Score:5, Funny)
Parent
No Soup For ... me? (Score:4, Insightful)
Re: (Score:2)
Also if you:
- change keyboards
- change your chair
- drink some coffee
- use an unusual posture
- catch the flu
- lose your palmrest
- ADD a palmrest
- get carpal tunnel syndrome or other RSIs
- lose a limb
- (I could go on for a LONG time)
I can definitely see this end
Reminds me of a story... (Score:2)
Any takers?
Re:Reminds me of a story... (Score:5, Funny)
Long penis.
Parent
Re: (Score:2)
Interesting you mentioned WW2... (Score:5, Informative)
I immediately thought of WW2 when I read the title. A Morse Code operator's style was called their "fist". German operators became quite adept at mimicing the fist of other operators, and using the fist to identify captured operators didn't work well. This is why they had other signals for identifying that an operator was not captured. Things that would look like a typographical or crypto error to a third party, but which was known to both the sender and receiver, and the absence of them would indicate capture. Of course, under stress, sometimes these were forgotten.
The book Silk and Cyanide has a great discussion of the fist and other identification techniques and how they failed and succeeded (mostly the former). Highly recommended.
Sean
No Drunk Internets :( (Score:3, Funny)
The obvious solution (Score:2, Funny)
Might come in handy... (Score:2, Interesting)
Re:Might come in handy... (Score:4, Interesting)
Parent
Morse vs. typing (Score:3, Interesting)
Richards has apparently forgotten that morse code uses 1-key as opposed to passwords which use 47 character keys with the ability for a person to hold down the shift key to enter in an alternate version of any of those.
Which means that, when a person starts using a new password, they type it fairly slowly. However, as they get used to typing it, they gradually get faster at it.
What do you do when your own system locks you out because you've gotten better at typing your own password?
Not very accurate for real world use (Score:3, Insightful)
Now, you could possibly argue that it only needs to be able to recognize 1 person or at most 2, you and "not you", as once it determines it is not you the system does not care about the specific identify. Still, until they get that number to 100% it's going to be more hassle than it's worth, especially at a place with a 3 attempt lockout policy or the like.
Nothing To See Here, Move Along (Score:5, Insightful)
I'm beginning to think we're going to have to work up a check-off-the-problems sheet for these new authentication schemes like we pass around for anti-spam "solutions".
Here, I see two problems off the cuff:
Color me unimpressed. Is it an incremental improvement over plain passwords? Yes, but not enough to go with a $34,000 plus $1.15/user fee structure, as cited in the article.
Re:Nothing To See Here, Move Along (Score:5, Insightful)
Almost all security is a tradeoff against usability. This one looks like a bad trade - you lose lots of usability for only a small increase in security.
Parent
Different typing methods (Score:2, Interesting)
I'd think that this system would have the user type their password multiple times looking for consistent spacing.
Seems like it would not work as I learn my passwd (Score:5, Insightful)
Evolving stream? (Score:3, Interesting)
back then (Score:3, Funny)
It was all netware back then....
I do this now. Sort of. (Score:2)
Some added security, but not much (Score:5, Interesting)
"You're sleepy, right. They have a few little measures to catch that. If after a couple of goes it seems you're not typing the way it expects you to type, it will ask some additional security questions."
Ahh, so really all they've really done is increased the number of passwords an attacker has to try by a factor of 3 or so. Then you hit the question and you know you have the right password. At that point you can either solve the security questions (probably not as nearly as tough as the password, especially since no one expects it to be used) or they keep making occational tries at logging in with the correct password until you find their cadence (probably not that hard).
Note that I doubt that an attacker getting the password then bailing when they hit the question will raise any red flags, chances are there will be so many false positives that no one will bother to follow up.
Ally, impostor... (Score:3, Funny)
"whether a message was sent by an ally or an impostor..."
...or a cat [bitboost.com].
--Rob
not for web apps, I assume (Score:3, Insightful)
How useful is this method going to be when it can't be used with web-based applications?
For one, how's the web browser going to obtain that keystroke timing info and pass it on to the host? A Javascript implementation would be trivial to circumvent. And an ActiveX-like implementation would be a security risk.
For another, what about stored passwords? I may use an identifiable cadence when typing in a new password for the first time, but if I choose to let my browser store that password, it's going to subsequently get pasted in at the speed of . How many false negatives will this cause?
Re: (Score:3, Interesting)