Typing Patterns for Authentication

Kelson writes "NPR's Marketplace is reporting on a new authentication scheme. BioPassword tracks the way you type your password: how long each key is depressed, the time between keystrokes, and overall speed. When someone tries to log into your account, it compares the pattern to what it has on file. It only allows you in if both the password and patterns match. The technique has been around a while. World War II Morse code operators used it to determine whether a message was sent by an ally or an impostor."

Fist

[Nimey]

A Morse-operator's style was referred to as his "fist". This is referenced in Cryptonomicon.

I think this is a pretty nifty idea, and I'm surprised it hasn't been done before.

Interesting you mentioned WW2...

[jafo]

No, I'm no going to say you invoked Godwin's Law right at the top of the article...

I immediately thought of WW2 when I read the title. A Morse Code operator's style was called their "fist". German operators became quite adept at mimicing the fist of other operators, and using the fist to identify captured operators didn't work well. This is why they had other signals for identifying that an operator was not captured. Things that would look like a typographical or crypto error to a third party, but which was known to both the sender and receiver, and the absence of them would indicate capture. Of course, under stress, sometimes these were forgotten.

The book Silk and Cyanide has a great discussion of the fist and other identification techniques and how they failed and succeeded (mostly the former). Highly recommended.

Sean

Re:Fist

[quarrel]

I think there a certain sub-cultures that still recognise peoples 'fists' ... :)

--Q

Re:Fist

[Chabil Ha']

Very astute, but, if you had listened to the report, if such a thing occurred, it would prompt you for other identifying questions to prove your identity.

Personal experience with BioPassword

[Anonymous Coward]

We have been offering BioPassword as an additional security feature for our web based application (Doc Mgmt). I have been fairly impressed with its capabilities.

You can configure a number of options such as # of attempts before activation which allows it to 'learn' your typing style.

You can also set the 'Pass/Fail' percentage. For instance 80% match so you don't have to type it in EXACTLY the same way every time.

Additionally you can disable BP for individual users if you wish (broken hand, etc).

Plenty of other configs for it as well. By and large, it has been a fairly hands-free security system once configured.

Re:Sharing Secrets

[cyphercell]

Why the fuck would you marry someone you don't even trust?

Why the fuck would you divorce someone that agreed to take care of you when you're old?

Anyways, lots and lots of married couples keep things from each other, it's in no way misogynistic or stupid, it's actually natural. From this perspective I find the GP funny, as a man who's been divorced, I think of it more as informative than anything. And please save the big words for when you really need them, people are using the "m" word far too often these days.

Re:Sharing Secrets

[cyphercell]

...lots and lots of married couples keep things from each other, it's in no way misogynistic or stupid, it's actually natural.

It's called privacy, everyone needs it, it is in no way misogynistic.

The last-reported U.S. divorce rate for a calendar year, available as of May, 2005, is 0.38% divorces per capita per year, ...

The National Center for Health Statistics recently released a report which found that 43 percent of first marriages end in separation or divorce within 15 years.

http://www.divorcereform.org/rates.html [divorcereform.org]

Good luck! I don't know how long you've been married, but all things considered, I think I did alright. Anyways, thanks for busting my balls and if you ever need advice for your divorce, you can count me out. ;)