Sign Your Name Online With A Mouse 236
icke writes "Soon, the way you use your mouse could help prove who you are. According to a BBC News article, scientists have found a way for people to sign their name online using a mouse instead of a pen. The technology, based on the research from Queen Mary College, University of London by Peter McOwan, 'uses a neural network to pick out the unique features of the way that someone uses a mouse.'"
How hard do you have to squeeze (Score:4, Funny)
Re:How hard do you have to squeeze (Score:3, Funny)
Re:How hard do you have to squeeze (Score:5, Funny)
Re:How hard do you have to squeeze (Score:2, Funny)
This would be easy to fake (Score:5, Insightful)
Re:This would be easy to fake (Score:5, Interesting)
Re:This would be easy to fake (Score:2, Interesting)
Re:This would be easy to fake (Score:5, Funny)
Re:This would be easy to fake (Score:2, Interesting)
I represent the opposite end of that spectrum. I got a Visa check card because I was sick and tired of having to show a photo id (with a photo already on my credit card). The commercials would seem to indicate that Visa check cards require no extra ID. However, I get asked for ID about twice as much now as I did before (with a regular credit card). I mean, my picture is RIGHT ON THE DEBIT CARD. *sigh* Why do you retail idiots ID
Re:This would be easy to fake (Score:5, Insightful)
Why do you not assume that the macro software could be "smart" and simply add some white noise to the playback?
Re:This would be easy to fake (Score:4, Insightful)
Re:This would be easy to fake (Score:4, Insightful)
Re:This would be easy to fake (Score:5, Informative)
Re:This would be easy to fake (Score:2)
It's a habit I've had since my dad bought a 128k Macintosh in 1984. The mouse cord simply wouldn't strech over to the left side.
Re:That's the point though.. (Score:5, Insightful)
...lest we forget the lefties... (Score:3, Interesting)
Except for those of us who have broken down and always use the mouse on the right side. Not sure what to say about that.
(My personal opinion is that lefties who switch their mouse buttons are just weak and only add confusion to the mix...but it is
Re:This would be easy to fake (Score:5, Funny)
Re:This would be easy to fake (Score:3, Interesting)
Actually, the anti-forgery algorithms that have been developed can tell when you're doing that; the better algorithms don't look for the outline of the letters you write (sign your name five times, and there will be differences between them), but instead look for the patterns of movement and speed while you're writing your name; if you're tracing a signature, your pen movements are going to be very different than
Re:This would be easy to fake (Score:5, Insightful)
In the case of this system, an arms race between the forger/loggers and the ID systems company would then ensue. The first countermeasure to mouse-loggers would be rejection of identical traces (as others have suggested). To this forgers would add statistical noise to the trace. The ID company would then need to create a more sophisticated statistical test that rejects traces that did not vary enough while staying within the statistical bounds of the 20 training samples that the systems asks for. An SVD on some transform of the sample signatures would help uncover both the strongest and weakest modes of variation. Signatures that did not match on the main pattern and did not vary sufficiently in expected way would be rejected. This would prevent either direct play-back or a simplistic addition of noise to the mouse trace.
The presence of both a predicable static pattern (the "average" signature) and modes of variation (because people don't actually sign their name identically to the nanometer/nanosecond) makes this biometric key better than other more invariant biometric features that can be copied.
Re:This would be easy to fake (Score:5, Insightful)
Why do people sign electronic pads at stores when they use credit cards?
You have just placed your last protection of who you are in a computer system that you have no control over.
Real dumb.
Re:This would be easy to fake (Score:3, Interesting)
Re:This would be easy to fake (Score:3, Informative)
The thing is... I really doubt this would be useful for 'stealing' an identity. Sure, when you're talking about credit card sigs, it might be slightly different, but r
Re:This would be easy to fake (Score:4, Interesting)
Well, a Challenge-Response mechanism that uses some sort of biometric feedback mechanism would seem to be the standard crypto authentication approach to this problem.
For example: use a subset of the bio-key to sign a packet, returned packet counter signed by authenticating service including a challenge mechanism (ie. pseudo-random light fluctuations to emitter in retinal scanner, measure and return eye muscle contraction patterns). This concept could possibly be implemented in the current system of 'mouse signatures' by the authenticator specifying a glyph or pattern for the user to input, rather than an (relatively) invariant pattern.
This does not exclude the possibility of compromise (even a 'statistically perfect' crypto algorithm can be extremely poorly implemented) but it would raise the bar - both in terms of complexity and time dependency.
The only perfect cryptographic solution is to not record anything, anytime, anywhere, ever...
Q.
Re:This would be easy to fake (Score:2)
Re:This would be easy to fake (Score:3, Interesting)
And hard to get right (Score:2)
(Yes, I have an office. Neener-neener.)
Most computers have mice.
I can't imagine that the motions of my whole arm for a mouse (or my thumb for the other kind of trackballs) would mimic those of my two fingers closely enough for me to sign anything anywhere that doesn't have the same or similar trackball that I'm used to.
Question (Score:4, Insightful)
Re:Question (Score:5, Interesting)
Many of laws now on the books in the U.S. allow a digitial signature to be binding if all parties agree on the digital method used.
So, if you can all agree on wiggling the mouse for a sig, then it can be legally binding.
interesting (Score:2)
What about the agreement for that one?
Re:interesting (Score:2)
What about the agreement for that one?
Depends on the State. Many "agreements" are verbal, with witnesses. For long term use, like with a bank or financial institution, the initial agreement is either written or witnessed.
For example, some places have you click an "I Agree" button, but a human verifies that it is you. Well, they check and ID or something. After that, you can sign things remotely.
Re:Question (Score:2)
The problem, ofcourse, is to prove exactly what was being said, with enough of a context that it's clear that all parties understood they where entering an agreement.
Paper and signatures are useful because it's a traditional method of finalising an agreement, thus when someone is asked to sign a contract, it's assumed that t
Warning: (Score:5, Funny)
Thank you for shopping at Victoria Secret.
How About... (Score:3, Funny)
Your John Handcock is not secure (Score:5, Insightful)
Use a cryptographic key to sign. You'll be glad you did.
Re:Your John Handcock is not secure (Score:2, Funny)
Honest mistake, or Freudian slip?
John Handcock (Score:5, Funny)
A lack of John Handcock is un-American(TM), dammit.
Re:Your John Handcock is not secure (Score:2, Funny)
Your 4096 bits are not secure (Score:2)
While it may be a strong key that impresses the geeks, your cryptographic key is not as secure as it would seem. Viruses are easy to make by skilled hackers.
Re:Your John Handcock is not secure (Score:5, Insightful)
___________
Re:Your John Handcock is not secure (Score:2)
Move to a new mouse? (Score:4, Insightful)
Works great (Score:3, Interesting)
... even easier with a pen mouse. (Score:4, Insightful)
David.
Re:... even easier with a pen mouse. (Score:2)
Re:... even easier with a pen mouse. (Score:2)
It's all in the experience. I wouldn't be surprised if more of that happens in the future.
Technology (Score:3, Interesting)
...and probably easily replicable, since an actual physical presence is unneeded, and the ability to play back a "mouse stroke" will be a capable feat by any second year CS major.
Great (Score:5, Funny)
Types of mouse (Score:4, Interesting)
trackball (Score:2)
few questions (Score:2, Offtopic)
will this have any effect on those nasty EULAs? do i really HAVE to agree to them now? i may be wrong but as far as i know clicking "I Agree" doesn't mean anything.
what differences does this have with mouse gesture recognition software?
Hmm.. (Score:2, Interesting)
Re:Hmm.. (Score:2, Funny)
yeah! (Score:2)
what about the differences between mice? (Score:4, Interesting)
right.... (Score:5, Insightful)
Re:right.... (Score:2, Interesting)
Sometimes it dificult enough for them to get the mouse to click on things accuratly. How would they be expected to cope with it.
Oh and how secure is the system? Well I'm right handed, but use the mouse left handed (annoys the hell out of anyone sitting at my desk) so how would I have to sign it. The angle of stroke would vary between real world right hand and virtual world left hand.
Signatures (Score:3, Interesting)
Another odd idea that'll never work (Score:5, Insightful)
Easy to fake with a mouse movement recorder.
Oh and what about people who use a trackball? does the smart biometric layer apply to those hand movements?
And the other obvious question : wouldn't it be easier to simply teach people why they should use properly formed passwords that are not "mom", "dad", "john1" or "s00persekrit"?
In short, yet another far-fetched solution to solve a non-problem.
Teaching about passwords is "easier"? (Score:3, Insightful)
Hmm. Why don't we ask the couple of generations of IT people who've tried to teach people this very lesson? Maybe they have something to say about that one. I could start with our call center: their number one call every month for the last five years has been "Please reset my password" despite several "education" campaigns.
People
Similar biometrics don't work (Score:5, Insightful)
dudes, they're lying (Score:5, Funny)
it's 99% accurate because of carelessness and post-lunchbreak bloat factor
Re:dudes, they're lying (Score:2)
mouse only? (Score:2, Interesting)
I use everything from a mouse to a touchpad to a roller ball.... is my signature the same using all of these things?
How will it know? I'd get really annoyed if I had to plug in a mouse on my laptop to sign for something.
Is this like Cybersign? (Score:5, Interesting)
Re:Is this like Cybersign? (Score:2)
A forger would have a hard time copying the variations in speed that the actual person uses even if the forger traces the same path or tries to "get good" at the signature.
Yeah, your kid brother would find it difficult to replicate your computer's behavior with another computer.
Your neighbor hacker would find it a challenge.
(and probably not a particularly hard one)
Doesn't sound promising (Score:3, Insightful)
The problem is that the actual person may also have a really tough time reproducing the same speeds, patterns, etc. in their signature.
This is why handwriting analysis/comparison is almost always inadmissable in court -- it's too variable.
The reasons for this are especially apparent when you look at the handwriting of people like myse
Variations in signatures are OK, even good (Score:3, Informative)
That is the entire point of a modal analysis of the signature. It captures not only the central tendency of the signature, but also the characteristic modes of variation. The idea is that everyone's signature varies in amounts and ways that are unique to that person. Some people might vary more on the first letter, the heights of letters, the shapes of loops, slant, th
Will failure automatically be "fraud" (Score:2)
pretty darn useless... (Score:4, Insightful)
so your signature is invalid if you use a laptop with a trackpoint,touchpad, or use a track ball or a tablet and a pen, etc.....
Neat idea, 100% useless in the real world.
Now if you can get a reliable identifier (How about something as simple as a ibutton ring (www.ibutton.com) and quit trying to invent the unique personal identifier that so far is only out DNA (no, no dna testers on our computers than you.)
Identification has always been tied to a unique card, number, whatever given out by a group or agency. Why not stick with the same thing just update it with current off the shelf technology that already works?
www.ibutton.com I use it to log into my computers at home, unlock my doors and even start my harley....
Re:pretty darn useless... (Score:2)
you'll learn instantly that they are 100 times better than any smartcard and because you can wear them as jewelery AND set them up to requre a pin to access their contents (or better yet run a java app inside the button to report a hash....)
they are more secure than your eyeball...
roll ball mouses (Score:2, Insightful)
Bullshit alert (Score:4, Funny)
+2, academic researcher
+2, academic researcher studying biologically inspired hardware and software
+1, biometrics
+1, researcher teaches multimedia
+2, researcher teaches computers in society
+2, no history of employment in real world
-1, degree in physics
------------------
+14, almost certainly bullshit
These journalists... (Score:2)
Another silliness (Score:2, Redundant)
I'd classify this invention as similar to Segway in its utter uselessness. Some laugh at people who ride Segway in a park instead of walking (as humans are built to do); in the same manner some would be laughing at people who are busily wiggling the mouse trying to buy something online, instead of plugging the key (or just their password) into the system.
Again we see an invention
Different devices (Score:2)
Now I'm Confused (Score:5, Funny)
Christ... first thing I did when I read that was stop moving my mouse.. then the thought crossed my mind that by doing that, I was just setting up a new signature, so I started moving the mouse. Then, I started to think that maybe I was moving the mouse in my own special way, so I tried to make something up.
Then it occurred to me that I'm using lynx.
Writing with a brick (Score:2)
My pre-web skills are centered around the use of writing utensils.
I've got a Wacom tablet that receives signals from either a mouse or a pen.
I never use the pen. It's annoying and far too sensitive. The right Rotring [rotring.de] used with skill and responsibility, on the other hand, is a thing of beauty.
ok... (Score:2)
...so what happens when you switch from a mouse to a trackball? I can't imagine the physical actions are that similar and must throw off the measurements somewhere.
Triv
Hope Microsoft doesn't find out... (Score:2)
How to Sign with a Mouse: (Score:2)
Maybe some mouse manufacturer will beat the crowd and include a pen like antenna that can be contained within the mouse, or taken out when needed.
Just a thought...
And the problem we're solving was ?? (Score:4, Interesting)
It does, though, raise a related issue which troubles me: is it a good idea to use technology to remove the transaction from the realm of ordinary human experience?
If you use a conventional signature, the person on the other side of the transaction can at least make a gross check that the signatures (as written, and as on the credit card, for example) match. But, if I am understanding this proposal correctly, all the matching occurs "inside the machine". I worry a bit about the unintended side effects of this: "the machine is always right!"
(BTW, I think one has a very similar problem with some of the proposed electronic voting systems. Traditional ballot papers are not perfect, but I think that at least a normally intelligent person can understand the security model.)
Rich
SCO delenda est.
The first step.... (Score:2)
This is the first step along the way to creating the Terminator series of personal assassination cyborgs.
The simple neural network picks out unique features of mouse movements, just like the Terminators
pick out unique faces for termination.
All I can picture is... (Score:2, Funny)
Purpose of a signature (Score:2)
The purpose of a signature is to be able for you to know that you signed it, not for someone else. I use different signatures at different times, but I know they are mine. To that extent, signing something with a mouse is just fine, for as long as you can tell _your_ signature appart from someone else's.
When a bank caches a check with your signature, they mostly don't look at the signature at all, and if they do, it's only a cautionary measure,
paranoia... (Score:3)
Great... as if I didn't have enough to worry about. Now I have to start more erratically using the mouse so I can't be tracked... except that being completely erratic can be a recognizable trait... ARGH!!!
I've done something like this (Score:5, Interesting)
Screw That! (Score:2)
I think if they want to truly be able to verify your identity, they'll have to eventually do some kind of real-time video verification where you s
Obligatory Clippy Joke (Score:2)
Oh great. So now i need to check 2 cables (Score:2)
I have an IntelliMouse.. (Score:2)
the EULA of the future? (Score:3, Interesting)
What about the EULA of tomorrow? If, instead of an ?I Agree? button we are presented with a ?Sign Here? white space, and the EULA states that by signing, both people agree that it is a binding contract?
See where I?m going?
Just don't have a stroke... (Score:2)
special mouse (Score:2)
If you really want to use a system like this (not that I would), just make a secure uber mouse which forms a secure connection to the mouse drivers (which also do the signature recognition), and require everyone to use that. Then the signature sequence is never seen in the clear unless someone
This is similar to Morse Code (Score:5, Interesting)
While this uniqueness didn't provide a surefire form of authentication, professionals who feared having a broadcast recognized would sometimes retire a coder after sending a particularly sensitive message.
Seems kinda like mouse analasys. You can't prove it's them, but it's another suggestion. Can't see how it'll be useful. The mouse is easy enough to hook into in the software side--it's by no means a secure device.
This won't work, and here's why: (Score:2, Troll)
It sounds like this system of verifying stuff won't work in the real world.
Trackman Marble SOL I suppose... (Score:2)
A better (and fannier) one (Score:2, Funny)
http://www.sitebits.com/2000/SIG/ [sitebits.com]
It is available since 2000.
MouseAlternatives? (Score:2)
Unless you are forced to use a mouse (not trackball, pen or weird device stuck to your head), this won't, IMHO, really work.
Mouse type (Score:2)
Non-portable signatures. (Score:2)
then it may well work ok.
But, you cannot, e.g. sign something when using a friends laptop if there isn't a mouse attached. You can't sign if the mouse is dirty and jumps around a little.
I bet the 99% accuracy was when using identical equipment for each of the test 'signings'.