Sign Your Name Online With A Mouse

icke writes "Soon, the way you use your mouse could help prove who you are. According to a BBC News article, scientists have found a way for people to sign their name online using a mouse instead of a pen. The technology, based on the research from Queen Mary College, University of London by Peter McOwan, 'uses a neural network to pick out the unique features of the way that someone uses a mouse.'"

Comments

How hard do you have to squeeze

[egg troll]

To get ink from a mouse? Yeesh.

Re:How hard do you have to squeeze

[Anonymous Coward]

I keep trying to write with a mouse, but the ink seems to keep coming out in little pellets... maybe it's time to replace the mouse balls?

Re:How hard do you have to squeeze

[EmbeddedJanitor]

I tried and the fscking thing bit me!

Re:How hard do you have to squeeze

[Warped-Reality]

It's just like getting baby oil from a baby..

Re:How hard do you have to squeeze

[SpiderJ]

No, just put the pellets in an old, dried out marker and then add water.

This would be easy to fake

[Megor1]

You could just record the mouse movements with some macro software and then play it back whenever it asks for their signature.

Re:This would be easy to fake

[swtaarrs]

If the software is smart, it will look for perfect reproductions which no human would be capable of and give an error if it detects one.

Re:This would be easy to fake

[krymsin01]

Well, I suppose it'd be trivial to check an see if one of the last couple hundred times you signed your name is am exact match (something I think only a macro, and not a human, could do), and if so, reject it.

Re:This would be easy to fake

[Anonymous Coward]

Yes, but if the human is smart, they would modify the playback macro just slighty, and in a believable way such that the algorithm determines that it is a valid signature.

Re:This would be easy to fake

[Anonymous Coward]

Next, just make a worm that gathers the motions of people signing their names, somehow passing along the motions to each new machine you infect. When the worm has enough signatures, start flooding web stores with orders for pink flamingos or something to be sent to the white house.

Re:This would be easy to fake

[Andrewkov]

If you've ever tried drawing anything with a mouse, you probably agree that it's not easy .. I probably couldn't even write my name and have it be recognizable as being written by the same person, let alone be an exact digital match. Maybe I'm a spaz on the mouse, but I know for a fact I'm *much* better than the average Joe-Sixpack type I see at work. So I have a hard time believing this concept will work. Stylus tablets is another story, though.. If only everyone owned one of those! :-)

Re:This would be easy to fake

[localghost]

And pens won't work either, because you can easily photocopy a signature and trace over it. Oh well, back to the drawing board...

Re:This would be easy to fake

[G4from128k]

Obviously if someonce can log the mouse motions with an accurate timestamp, then they can replicate the signature. But then EVERY computer-connected biometric ID system is potentially susceptable to interception/replay of the biometric key signal.

In the case of this system, an arms race between the forger/loggers and the ID systems company would then ensue. The first countermeasure to mouse-loggers would be rejection of identical traces (as others have suggested). To this forgers would add statistical noise to the trace. The ID company would then need to create a more sophisticated statistical test that rejects traces that did not vary enough while staying within the statistical bounds of the 20 training samples that the systems asks for. An SVD on some transform of the sample signatures would help uncover both the strongest and weakest modes of variation. Signatures that did not match on the main pattern and did not vary sufficiently in expected way would be rejected. This would prevent either direct play-back or a simplistic addition of noise to the mouse trace.

The presence of both a predicable static pattern (the "average" signature) and modes of variation (because people don't actually sign their name identically to the nanometer/nanosecond) makes this biometric key better than other more invariant biometric features that can be copied.

Re:This would be easy to fake

[cpuffer_hammer]

The system could ask the user to also write something, (like the date, the name of the product, or the PO). This would make it hard to have the correct recording including all the connected letters. Of course this also make the training/preperation before the system can be used the first time harder.

Re:This would be easy to fake

[s88]

" If the software is smart, it will look for perfect reproductions which no human would be capable of and give an error if it detects one."

Why do you not assume that the macro software could be "smart" and simply add some white noise to the playback?

Re:This would be easy to fake

[c0dedude]

And if the human is smart, it will design software that embeds flaws.

Re:This would be easy to fake

[jackb_guppy]

Which then leads:

Why do people sign electronic pads at stores when they use credit cards?

You have just placed your last protection of who you are in a computer system that you have no control over.

Real dumb.

Re:This would be easy to fake

[srmalloy]

And pens won't work either, because you can easily photocopy a signature and trace over it.

Actually, the anti-forgery algorithms that have been developed can tell when you're doing that; the better algorithms don't look for the outline of the letters you write (sign your name five times, and there will be differences between them), but instead look for the patterns of movement and speed while you're writing your name; if you're tracing a signature, your pen movements are going to be very different than the original signer's was.

Re:This would be easy to fake

[E_elven]

Because we all know that *actual* signatures cannot be forged and the clerks at stores are really hawk-eyed when it comes to making sure the customer is who they say they are.

Re:This would be easy to fake

[quinkin]

"...EVERY computer-connected biometric ID system is potentially susceptable to interception/replay of the biometric key signal."

Well, a Challenge-Response mechanism that uses some sort of biometric feedback mechanism would seem to be the standard crypto authentication approach to this problem.

For example: use a subset of the bio-key to sign a packet, returned packet counter signed by authenticating service including a challenge mechanism (ie. pseudo-random light fluctuations to emitter in retinal scanner, measure and return eye muscle contraction patterns). This concept could possibly be implemented in the current system of 'mouse signatures' by the authenticator specifying a glyph or pattern for the user to input, rather than an (relatively) invariant pattern.

This does not exclude the possibility of compromise (even a 'statistically perfect' crypto algorithm can be extremely poorly implemented) but it would raise the bar - both in terms of complexity and time dependency.

The only perfect cryptographic solution is to not record anything, anytime, anywhere, ever...

Q.

Re:This would be easy to fake

[seite-f00f]

since:
"It's an extra biometric layer on top of traditional passwords,"
and:
"It's another way of indicating that you as an individual are sitting there on the end of the line."

you have to have (at least remote) access to the terminal the victim is using, 'cause this system is likely just another (and IMHO not so inovative) way to secure the access to (local) stored passwords/private keys.
if you have already access to the terminal there are other (easier) ways to get the stored passwords/keys.

Greetings from _OLD_ europe

Re:This would be easy to fake

[jaybird144]

In my experience, when the electronic pad is an option, signing a paper copy isn't. I asked once at Best Buy if I could just sign a paper receipt, and I was told that they didn't do that anymore. So, when I want to buy my toys, I have to either sign the stupid pad, or carry wads of cash on me. Neither option is very appealing for me.

Re:This would be easy to fake

[Anonymous Coward]

If you want to fake someones signature at the bank, you don't macro'ize his signature at the bank, but the one he used somewhere else. You cannot have a central database of every single signature a person ever wrote, to make sure it is not a copy of one of them.

Re:This would be easy to fake

[SEWilco]

orders for pink flamingos to be sent to the white house.

"The economy is improving. Manufacturing is increasing, delivery services have more business, demand for metal and oil products has increased. And there will be another tax cut because the White House eBay income has never been better."

Re:This would be easy to fake

[Anonymous Coward]

I want to know where you live because where I live the clerks could care less about identity and ofter only look at id's to avoid trouble not to check if it is valid etc.

Re:This would be easy to fake

[gfody]

everytime I sign one of those computer pad things (like at best buy). the sample rate is so slow that my "signature" ends up being five or six lines in different directions and it NEVER looks the same twice. whats the point of signing the thing? for a while now when I sign those things I just put an "X"

Re:This would be easy to fake

[CGP314]

Because we all know that *actual* signatures cannot be forged and the clerks at stores are really hawk-eyed when it comes to making sure the customer is who they say they are.

The signature on my credit card says 'Check Photo ID'. Not one clerk ever has.

Re:This would be easy to fake

[CGP314]

Or I could make my own neural net to generate sigs that pass.

Re:This would be easy to fake

[gfody]

or make the challenge a game of tic-tac-toe with a tic-tac-toe schema generated by the authentication server to be unique strategy/behavior/timing so to extract some psuedo-psychological biometrics from the user.. the tic-tac-toe engine would used signed schemas generated by xml via .net framework distributed to the thin client for decryption. its fun to pull shit out've your ass on slashdot isnt it?

Re:This would be easy to fake

[random_static]

what error? every paycheck i ever got had a "signature" rubber-stamped on it.

Re:This would be easy to fake

[Anonymous Coward]

Seems like someone needs a sarcasm adjustment :p

Re:This would be easy to fake

[untaken_name]

The signature on my credit card says 'Check Photo ID'. Not one clerk ever has.

I represent the opposite end of that spectrum. I got a Visa check card because I was sick and tired of having to show a photo id (with a photo already on my credit card). The commercials would seem to indicate that Visa check cards require no extra ID. However, I get asked for ID about twice as much now as I did before (with a regular credit card). I mean, my picture is RIGHT ON THE DEBIT CARD. *sigh* Why do you retail idiots ID me, when my picture is on my card, but the soccer mom writing a $2.50 check in front of me gets through with no hassle? I'm all for implanting lcd screens in our foreheads that display info like current bank balance. Think how much easier that'd make shopping, and dating! Now she can check out your salary before she even fake smiles at you.

Re:This would be easy to fake

[David Leppik]

I know I can't sign my name with the mouse. I'm left handed, but I use my right hand for the mouse.

It's a habit I've had since my dad bought a 128k Macintosh in 1984. The mouse cord simply wouldn't strech over to the left side.

Re:This would be easy to fake

[paRcat]

I wrote the software for my company's delivery handhelds that captures the signature of the person accepting the merchandise. I came up with a fairly novel way of storing the data so that each sig only uses ~1K... which makes it easy to send over a CDPD wireless connection to my server. At this point I have about 33000 sigs in a database.

The thing is... I really doubt this would be useful for 'stealing' an identity. Sure, when you're talking about credit card sigs, it might be slightly different, but really...

The reason I think technology like this will never be implemented is that everyone, depending on their current state of mind, can sign at two separate times and look like two different people. Once someone is turned away at a sale because they were too sleepy or had a couple beers, the whole point of this would be useless.

Re:This would be easy to fake

[Zerbey]

I don't even use those wretched things, the signature that the machine captures never looks like my regular signature. 99.9% of retail stores support using your debit card and entering a pin number, far more secure in my opinion.

All of my VISA cards have "check ID first" written in the signature block, so far I've been asked for ID maybe half a dozen times in the last year (I use my cards every day). Most place don't even look at the signature.

Re:This would be easy to fake

[Archfeld]

they even look for ID's where you are...they are on the ball there....they rarely lift their eyes from the cash machine here....

Re:This would be easy to fake

[Cyberia]

hmmm... You are treading in shark infested waters...

M$ claims prior art on this one...

Re:This would be easy to fake

[Rude Turnip]

That is because they have been instructed by Visa and Mastercard to *ignore* any special instructions you have added to the card. They're just following their contract with the card companies.

Re:This would be easy to fake

[Mr. Slippery]

The signature on my credit card says 'Check Photo ID'. Not one clerk ever has.

If they did, and if they knew the right thing to do, they'd make you sign it - the card is not valid until signed. But yes, signatures are very rarely checked - and of course there are many instances (gas pumps with card readers, for example) where there're not even a pretext of possible checking.

Re:This would be easy to fake

[Verne]

dude. If you're gonna put it in bold, at least put it in upper-case...

Re:This would be easy to fake

[jackb_guppy]

I have written one too. Mine makes the sig from 300 to 800 bytes. We were using cell phones as our backbone, some 8 years ago.

Basiclly, fax logic, with three encyption levels.
sig --> non-black,black,non-black,black; --> left handed loading encrytion --> standard encryption. Was a fun project to do, but I would not sign my name even during testing. I drew trains and planes (was for the travel industry).

Re:This would be easy to fake

[jackb_guppy]

The point is signed it. Now if a programmer with the rest of your electronic card information attaches it to another account "acidently" - how are you prove you did not sign it?

That is where by never signing one of those things, you have position in court to support your claim. IE were is the paper receipt? He are my cleint's other paper receipts.

Re:This would be easy to fake

[dbc001]

credit card photos are easier to forge than drivers license photos.

Re:This would be easy to fake

[gfody]

do you know what burden of proof is? I'll never have to prove I didn't do anything.

Re:This would be easy to fake

[paRcat]

Yeah... that's what I almost did, but I decided to store the signature as a series of x/y coords. The nice thing about that is I can actually fake a higher resolution by smoothing the curves and antialiasing on the server side... neato.

But back to the point... why not sign your name? I mean, seriously. What would someone have to gain by faking your signature? And if you answer that question with 'money', please don't bother. You're only liable for $50 if your credit card is stolen... so what else could they do?

Re:This would be easy to fake

[untaken_name]

credit card photos are easier to forge than drivers license photos.

So what? Their entire ad campaign is based on the 'you don't have to show id' idea. However, in practice, you *do* have to show id. That smacks of false advertising to me.

Re:This would be easy to fake

[(54)T-Dub]

It's not at the store that it matters. You could sign an X if you wanted to. The signature becomes an issue if you try to contest the charge. That's when the Credit Card company will pull the signature and match it to other signatures.

Question

[AnimeFreak]

Would a signature created with a mouse be legally-binding?

Re:Question

[chill]

Would a signature created with a mouse be legally-binding?

Many of laws now on the books in the U.S. allow a digitial signature to be binding if all parties agree on the digital method used.

So, if you can all agree on wiggling the mouse for a sig, then it can be legally binding.

Re:Question

[Eivind]

Actually, all agreements where all involved parties agree and are aware that they're entering an agreement are legally binding. Yes, even a verbal agreement is fully legally binding.

The problem, ofcourse, is to prove exactly what was being said, with enough of a context that it's clear that all parties understood they where entering an agreement.

Paper and signatures are useful because it's a traditional method of finalising an agreement, thus when someone is asked to sign a contract, it's assumed that they understand this means entering an agreement

Any other method would be similarily ok IF it was well-recognized in society that going trough this spesific ritual means entering an agreement, and going trough the ritual leaves some sort of physical evidence that can be atleast to some degree proven later.

Warning:

[Exiler]

Vertical motions detected. Credit authorization failed.

Thank you for shopping at Victoria Secret.

How About...

[Suhas]

...I know all the kbd shortcuts and rarely use my mouse....err... ...You Insensitive CLOD!

Your John Handcock is not secure

[Dancin_Santa]

While it may be a huge flourish that impresses the ladies, your signature is not as secure as it would seem. Forgeries are easy to make by skilled criminals.

Use a cryptographic key to sign. You'll be glad you did.

Re:Your John Handcock is not secure

[Anonymous Coward]

Yeah my signature gets me laid ALL the time.

Re:Your John Handcock is not secure

[BradleyUffner]

"Yeah my signature gets me laid ALL the time.
"

Perhaps you should switch to paper instead of snow. That minght help.

Re:Your John Handcock is not secure

[heli0]

"Your John Handcock"

Honest mistake, or Freudian slip?

Re:Your John Handcock is not secure

[OmnipotentEntity]

The added fact that most skilled forgeries are identified by the depth of the pit in the paper (ie how hard you press down at certain points, you can imitate a shape but if you imitate it you're not doing it naturally and that shows in the patterns of heavy vs. light inking), and not by the shape of the writing, that makes the mouse signature doubly insecure. Any idiot can trace a pattern of pixels if they see it a few times.

___________

Re:Your John Handcock is not secure

[Anonymous Coward]

Any idiot can trace a pattern of pixels if they see it a few times.

That's why you incorporate time data into the mouse signature. It accomplishes essentially the same thing.

Re:Your John Handcock is not secure

[redJag]

"Your John Handcock"

Honest mistake, or Freudian slip?

That's the thing with "Freudian slips," the person doing it sees it as an honest mistake, psychologists see it as a "Freudian slip," and I see it as a "who gives a shit?"

Re:Your John Handcock is not secure

[s-orbital]

A freudian slip is where you say one thing, and mean your mother.

Re:Your John Handcock is not secure

[oshy]

There was a signiture recogiser thingie they were showing on Tomorrows World. As well as the shape of your signiture, it measured pressure and time taken to do various parts of it.

Besides most of the shops I've been in don't check my signature against the card. Some hand it back before I sign and some hand it back with my copy and don't even look.

Re:Your John Handcock is not secure

[redJag]

Hey, that's actually pretty funny. :)

well damn...

[Kewjoe]

im screwed, i only use a keyboard :(

Re:well damn...

[Anonymous Coward]

I have 8 switches. I use them to key in the 8-bit value for the letter I want to type, and push a button.

Move to a new mouse?

[jpsowin]

And what happens when you change to a different type of mouse? My change to wireless optical was quite a change which took some getting used to, and I'm sure it didn't "sign" the way I used to. Or whatever. :)

Re:Move to a new mouse?

[idontrtfm]

I have taught classes to engineers, and their managers sometimes show up. I have seen managers try three times to click on the title bar of a window. Consistantly double clicking correctly is beyond some lusers. Notice this was tested against college students who have used their computers forever. By the time this technology is ready most of the computer illiterates should be dead.

Re:Move to a new mouse?

[DroopyStonx]

Tell me about it. I'm left handed. I use my mouse with my right hand. If I try to write words, there are backwards letters, squiggles, and new letters that I didn't even know existed.

Re:Move to a new mouse?

[Anonymous Coward]

Consistantly double clicking correctly is beyond some lusers
I yoosed to be unabl to spel enginair and now I are won!
By the time this technology is ready most of the computer illiterates should be dead
Yes, but what about the other illiterates?

Re:Move to a new mouse?

[El Brazo Onofre]

Due to RSI and the nature of my work, I use several different types of mice, including a full-sized trackball mouse, a thumb-controlled trackball, and a trackpoint. So I could sign things at home but not at work and not on business trips? Arf.

Works great

[Gay Nigger]

Until you get a wireless mouse. I've got one of those expensive Logitech mice, and even then, it moves erratically without warning. Not exactly good for predictable signatures, if you ask me.

Re:Works great

[Rhone]

Assuming your mouse is optical, maybe there's something about your table surface that's messing with it?

I have a Logitech optical mouse (not wireless), which always worked perfectly fine for me. Then I went home (from college, where I was living on campus) for a summer and suddenly found that at seemingly random intervals, my mouse pointer would make sudden erratic movements. I figured that it was just something that happened to optical mice when they get old.

Then I went back to school and the problem went away. After a couple more breaks spent at home, I realized that the problem was my computer desk at home--it only has that problem on that desk. At school, and now in my new apartment (with a new desk), the mouse has never had any problems.

Re:Works great

[Gay Nigger]

Hey, yeah, you're right! I've been using it without the mousepad for an hour or so now, and it seems to work fine. Many thanks!

... even easier with a pen mouse.

[OzPixel]

My girlfriend had a pen-shaped mouse for a while, (wrist problems), and I'd imagine signing would be much more "natural" with one of those. Neat idea, though ...

David.

what if...

[Kewjoe]

you switch mice? go from a trackball to a normal mouse, or go to a touch pad? there is no way you can write a signature the same way. Would you have to have a signature for every mouse in existence?

Sign it

[Anonymous Coward]

How does this work when you use a trackball? What about if I have two mice, will it still work then?

Technology

[mao che minh]

"The technology, based on the research from Queen Mary College, University of London by Peter McOwan, 'uses a neural network to pick out the unique features of the way that someone uses a mouse..."

...and probably easily replicable, since an actual physical presence is unneeded, and the ability to play back a "mouse stroke" will be a capable feat by any second year CS major.

Great

[Crashmarik]

Just what I need. Computers to tell me I'm not me when I sign my name. At least with people I could make a convincing argument.

Re:Great

[Anonymous Coward]

At least with computers I could make a convincing argument that I'm you.

daft

[Anonymous Coward]

and when I buy a new mouse, I've got a new unique signature because every mouse is different.

Optical/Digital

[frankthechicken]

The security system works with both optical and mechanical mice.

Before I read the article this was the first thing that leapt to my head.

Though I do still wonder whether it can pick up and ignore some of the idiosyncracies an anolog mouse may intoduce(i.e pieces of fluff on the rollers affecting the natural flow of the mouse etc.).

Damn

[Anonymous Coward]

Will there ever be a use for my graphic tablet? I can't draw, so I thought maybe I could use it to sign my name but now I cant even use it for that??

(p.s. i cant actually sign my name either, or write. yay for 10 years of typing)

Types of mouse

[Cavalkaf]

What about if you change your mouse type to something like a trackball or a laptop mouse? Your signature wouldn't work anymore, and you cannot access anything from other computer!!!

few questions

[leekwen]

will changing my mouse, maybe to a higher/lower resolution mouse, different shape of mouse, a touchpad, a trackball, etc. change my signature? if so, how is this supposed to work? signing my name with a different pen doesn't change my signature.

will this have any effect on those nasty EULAs? do i really HAVE to agree to them now? i may be wrong but as far as i know clicking "I Agree" doesn't mean anything.

what differences does this have with mouse gesture recognition software?

Re:few questions

[phritz]

As far as EULAs:

The reason they're not enforcable is that you are asked to sign it after you've already paid for the software. If they were to have any smidgen of legal validity, you would have to sign the EULA as part of the transaction when you buy the software itself.

So, no, even if they made you mouse-sign your EULA, it still wouldn't mean jack.

Re:few questions

[Greventls]

clicking I agree means you agree.

Hmm..

[DroopyStonx]

I don't think this will take off. Ever tried signing your name with your mouse? Reminds me of pictures I'd draw and put my name on when I was 4. When I use my credit card in person, each and every time I sign it differently so it DOESN'T match the signature on the back of my card just to see if anyone says anything. No one says a word. Even got away with signing "Blooooopy!" and no one noticed (no, my name is not Blooooopy!) If existing methods are trivial, how would this method work?

Re:Hmm..

[Greventls]

Yeah. I agree with you. I sometimes alter the spelling of my name when I'm signing and no one says a damn thing. It is pretty noticable if my name is mispelled, since it is very common. Maybe the software will act like the lazy bank tellers and cashiers and just not care.

yeah!

[alexandre]

We can finally write "signature sniffers" hehe..

what about the differences between mice?

[strider3700]

Will I have 3 signatures since On this box I have a trackman that I prefer to use. Sitting right beside me I have a standard old mouse and at work I have an optical mouse. All three take time for me to get used to again each time I switch. I have to assume that it's because I'm using them slightly differently, due to the feedback. As well if I change something like the mouse acceleration because things seem to slow one day It takes awhile for me to come back into practice. How Do they deal with these changes?

right....

[hawkbug]

Because I always use a mouse the same way, this will work great.... Not. I have many different computers, all with different types of mice and software. Trackballs, eraser-head laptops, trackpad laptops, and don't even get me started about different operating systems and the software they use. This is not going to work for many reasons, and I hope business realize this sooner than later.

Re:right....

[Anonymous Coward]

You pessimistic sod! ;)

Re:right....

[Ieshan]

Yeah, but if they brought you into the store and gave you a computer to sign your name with, think of the ink we could save!

Re:right....

[oshy]

Not to mention people like my parents. They are starting out in the world of computing in their 'later years'.
Sometimes it dificult enough for them to get the mouse to click on things accuratly. How would they be expected to cope with it.

Oh and how secure is the system? Well I'm right handed, but use the mouse left handed (annoys the hell out of anyone sitting at my desk) so how would I have to sign it. The angle of stroke would vary between real world right hand and virtual world left hand.

Signatures

[jakek101]

Signatures are useless, there are no good way to check them. Hell, my signature seems to change every time I write it and nothing happens. The mouse signature will be at least slightly secure if there is software to check it. It would really be best if we switched to a differnt system for this kind of stuff. Thumb print or something. I know you can reproduce someone's thumb print, but it's not THAT easy.

My signatures sucks too...

[gaber1187]

If my signature was used to train a neural network, the transfer function it found would be loosely translated in novell netware to GRANT ALL TO ALL.

:-)

Another odd idea that'll never work

[Rosco P. Coltrane]

"It's another way of indicating that you as an individual are sitting there on the end of the line."

Easy to fake with a mouse movement recorder.

Oh and what about people who use a trackball? does the smart biometric layer apply to those hand movements?

And the other obvious question : wouldn't it be easier to simply teach people why they should use properly formed passwords that are not "mom", "dad", "john1" or "s00persekrit"?

In short, yet another far-fetched solution to solve a non-problem.

Re:Another odd idea that'll never work

[Dorothy 86]

Oh and what about people who use a trackball? does the smart biometric layer apply to those hand movements? That is a very good point. Seeing as how I personally use a trackball, it would be nearly impossible for me to use this system. The way your thumb moves is more or less eratic, unlike hand movements, which are more controlled. I think this idea is a neat thing, but otherwise useless.

Re:Another odd idea that'll never work

[Anonymous Coward]

s00persekrit

And what the hell is wrong with that one? I think you're being overly picky now. That one satisfies nearly every criteria I've ever seen for a reasonably secure password:

• Contains letters and numbers
  
• Does not contain dictionary words
  
• Is more than 8 characters long
  

Stop trying to be such a superior prick. You're not (superior, that is).

Re:Another odd idea that'll never work

[dbingamon]

This whole idea of using signature online is crazy. Besides, no two of my same signature ever looks that same - how would a computer recognize that.

Similar biometrics don't work

[thepacketmaster]

After recently studying for the CISSP, I learned a great deal about biometrics. The most accurate biometrics include things like iris scans, palm scans, retina scans, etc. These are so accurate because they measure characteristics that are totally unique to individuals. Signature dynamics and keystroke dynamics are some of the most ineffective biometrics around. A big problem is they can be faked. While the article states that early trials are 99% accurate, it doesn't detail how many people have actually tried this system. (A test group of 10 wouldn't be very good.) It also doesn't mention if they tried to fake it out. The real world is a harsh place on biometrics.

Re:... even easier with a pen mouse.

[jpmkm]

It's not a signature in the sense of signing a contract with a pen signature. It just detects different characteristics of how you move your mouse, which ends up being pretty unique. The article says it can be your name or some other identifying symbol. I don't think it really has anything to do with being "natural".

dudes, they're lying

[bongobongo]

it's just ms paint with a web front end and a bunch of offshore labourers visually verifying each one !!!! ! !!

it's 99% accurate because of carelessness and post-lunchbreak bloat factor

Re:dudes, they're lying

[WickedClean]

And don't forget about the pothead interns who stayed up all night drinking Natural Light and watching Cosby reruns on Nick at Night.

mouse only?

[thung226]

I use everything from a mouse to a touchpad to a roller ball.... is my signature the same using all of these things?

How will it know? I'd get really annoyed if I had to plug in a mouse on my laptop to sign for something.

The CIA and NSA should love this!

[Anonymous Coward]

It's like a built-in cookie! Install some (real) spyware everyplace and track people at Internet cafes. Imagine being "wanted" and unable to use a mouse anywhere without causing an immediate convergence of feds. Or simply "watched" and tracked from computer to computer causing everyone in your path to be tagged as one of your associates.

Command line? Nope, probably you could do similar analysis on keyboard timings.

This is some scary technology if you ask me.

Re:The CIA and NSA should love this!

[jakek101]

Think about the ammount of money it would take to monitor all the mouse movements of everybody all the time. Simply the ammount of traffic on the 'net this would create is insane. That's all beside the point when you realize the technology is for anilization of a pictogram you make with your mouse. If someone who is wanted sends his own pictogram over the net he has the the same chance to be caught as a criminal who sends his name or credit card number.

Re:The CIA and NSA should love this!

[Anonymous Coward]

Think about the ammount of money it would take to monitor all the mouse movements of everybody all the time.

1) cheap compared to an Iraq War.
2) you don't send the mouse movements, only "hits"

Detecting a signature from a mouse?

[Snarfangel]

That's nothing, I came up with a program that not only detects the keys a person types, but the unique order they are typed in. I call this set of ASCII characters a "name."

laptops?

[justforaday]

what about people using laptop trackpads? or those pencil eraser nubs?

Is this like Cybersign?

[G4from128k]

This looks like a variation on what the folks at Cybersign do. Their technology is based on matching the dynamical pattern of motion, not just the X-Y coordinate trace. A forger would have a hard time copying the variations in speed that the actual person uses even if the forger traces the same path or tries to "get good" at the signature.

Re:Is this like Cybersign?

[AEton]

A forger would have a hard time copying the variations in speed that the actual person uses even if the forger traces the same path or tries to "get good" at the signature.

Yeah, your kid brother would find it difficult to replicate your computer's behavior with another computer.

Your neighbor hacker would find it a challenge.

(and probably not a particularly hard one)

Will failure automatically be "fraud"

[LetterJ]

I ask mostly because my signature is pretty "loopy" and occasionally the little boxes that people want me to sign in are too small and *I* wouldn't consider the result to be a "match". None of my credit cards looked like my real signature until I started just signing them with a Sharpie and going outside the box.

University of Central Oklahoma

[wmaker]

I work for the University of Central Oklahoma, and they were asking me to write something that could do that for web verification for an online application for school enrollment. I found it rediculous as no normal person could make a readable sig with a mouse, and I told them so.

Is it me or...

[JFMulder]

1) This is a slow news day
2) Researchers need to go out a little, stretch out their legs, breath some fresh air and start thinking about USEFULL things?

What If

[SirDrinksAlot]

What if you use a trackball on one machine and a mouse on another?

I have one of each on both of the computers I Use. A Trackball on my laptop since I dont really need a surface to use it and an optical mouse on my desktop machine.

Wouldnt my fingerprint be different on each of my machines then?

Method of tracking or authentication?

[Anonymous Coward]

Two things crossed my mind when I read the article summary:

1) Using this as a method to track users, you could identify a person by their mouse movements on a public system perhaps.. kind of scary.

2) As a method of authentication .. although I think that would be insecure, but it would make a great addition to an existing method of authentication. A user types in their name, password and has to pass a challenge using the mouse in order to gain access.

Now I have not yet read the article, so my above ideas might be useless depending on just how reliable this whole idea is, then again my above topics might even be in the article. Just thought i'd comment with my initial thoughts. Sounds kind of neat.

You dim sum

[timlyg]

I was already doing that since it was called a "mouse".

interesting

[Perianwyr Stormcrow]

So, is a digital signature valid for the agreement that authorizes the use of the digital signature?

What about the agreement for that one?

Re:interesting

[chill]

So, is a digital signature valid for the agreement that authorizes the use of the digital signature?

What about the agreement for that one?

Depends on the State. Many "agreements" are verbal, with witnesses. For long term use, like with a bank or financial institution, the initial agreement is either written or witnessed.

For example, some places have you click an "I Agree" button, but a human verifies that it is you. Well, they check and ID or something. After that, you can sign things remotely.

Re:interesting

[Anonymous Coward]

I signed up for a retirement account online at Vanguard and it used digital signatures, I think. I didn't have to send in any paperwork or talk to anybody and I did it from my house. I had the option of sending in the applications but I declined.

Re:... even easier with a pen mouse.

[questamor]

Curiously, I've been using a mouse for graphic work since 1985. I can sign my name much more naturally and fluidly with a mouse than on paper, or on a graphics tablet.

It's all in the experience. I wouldn't be surprised if more of that happens in the future.

pretty darn useless...

[Lumpy]

So the "signature" is tied to a specific pointing device...

so your signature is invalid if you use a laptop with a trackpoint,touchpad, or use a track ball or a tablet and a pen, etc.....

Neat idea, 100% useless in the real world.

Now if you can get a reliable identifier (How about something as simple as a ibutton ring (www.ibutton.com) and quit trying to invent the unique personal identifier that so far is only out DNA (no, no dna testers on our computers than you.)

Identification has always been tied to a unique card, number, whatever given out by a group or agency. Why not stick with the same thing just update it with current off the shelf technology that already works?

www.ibutton.com I use it to log into my computers at home, unlock my doors and even start my harley....

Re:pretty darn useless...

[Anonymous Coward]

This advertisement brought to you by:
iButton.com

Re:pretty darn useless...

[Lumpy]

instead of slamming something I found that rocks and am excited about, spend $20.00 on a few buttons and a reader and play with them.

you'll learn instantly that they are 100 times better than any smartcard and because you can wear them as jewelery AND set them up to requre a pin to access their contents (or better yet run a java app inside the button to report a hash....)

they are more secure than your eyeball...

roll ball mouses

[wmaker]

what about the mice that are controlled with your thumb, you know the ball that you move. i doubt it would work well with one of those mice

Your 4096 bits are not secure

[achurch]

While it may be a strong key that impresses the geeks, your cryptographic key is not as secure as it would seem. Viruses are easy to make by skilled hackers.

Bullshit alert

[exp(pi*sqrt(163))]

+5, uses neural network technology
+2, academic researcher
+2, academic researcher studying biologically inspired hardware and software
+1, biometrics
+1, researcher teaches multimedia
+2, researcher teaches computers in society
+2, no history of employment in real world
-1, degree in physics
------------------
+14, almost certainly bullshit

These journalists...

[TexVex]

Early trials of the system on students in the computer science department at Queen Mary showed that it was 99% accurate in spotting who was using a mouse to sign.

That could have been written better. Or does that really mean the system is only trying to distinguish who is signing with a mouse, as opposed to something else like a tablet or their tongue on a touch screen?

HEH REDUNDANT

[SirDrinksAlot]

Damn the rate ppl post on here. This is redundant before I hit submit and didnt even know it.

Another silliness

[tftp]

What was the problem they are solving? How again it is better than a password, or a X.509 certificate stored in your USB key?

I'd classify this invention as similar to Segway in its utter uselessness. Some laugh at people who ride Segway in a park instead of walking (as humans are built to do); in the same manner some would be laughing at people who are busily wiggling the mouse trying to buy something online, instead of plugging the key (or just their password) into the system.

Again we see an invention that solves a problem that does not exist... could they please find a problem and only then get busy? Is it too much to ask, for example, to develop a wireless mouse that is using forward error correction and checksums, so that it does not "jump around" as most wireless garbage does? That would be something useful.

Different devices

[sstrick]

What happens when I swap between my home computer (normal mouse) and my laptop (touchpad)?

Now I'm Confused

[the_mad_poster]

Christ... first thing I did when I read that was stop moving my mouse.. then the thought crossed my mind that by doing that, I was just setting up a new signature, so I started moving the mouse. Then, I started to think that maybe I was moving the mouse in my own special way, so I tried to make something up.

Then it occurred to me that I'm using lynx.

Looks like we found a European

[Anonymous Coward]

Jerking off to shit porn?

Disgusting.

Writing with a brick

[pipingguy]

My pre-web skills are centered around the use of writing utensils.

I've got a Wacom tablet that receives signals from either a mouse or a pen.

I never use the pen. It's annoying and far too sensitive. The right Rotring used with skill and responsibility, on the other hand, is a thing of beauty.

ok...

[Triv]

...so what happens when you switch from a mouse to a trackball? I can't imagine the physical actions are that similar and must throw off the measurements somewhere.

Triv

mouse signature

[mjc_w]

I use a trackball. If you think mouse sigs
are childish, try it with a trackball!

Re:... even easier with a pen mouse.

[Anonymous Coward]

BTW, I'm sorry she developed those wrist problems after being with me, but man! she just goes and goes and goes....

Allready here folks!

[gnu-sucks]

And its called pbrush, lives in c:\windows\ if you use windows pre-nt

Mac users will recall MacPaint

Both these programs, magically, record vertical and horizontal mouse movements on a two-dimentional area known as a 'mouse pad'.

This program is able to record signatures, incredably, into a file on a 'computer'.

Using 'diff' (requires unix or cygwin), the two files can be compared and a difference reflected in a numerical value.

WHAT will they think up next!?!

How hard do you have to squeeze-mouse "balls"

[Anonymous Coward]

"I tried and the fscking thing bit me!"

Apparently you grabbed the wrong thing.

Hope Microsoft doesn't find out...

[anthony_dipierro]

We may see the click-through license replaced with the sign-through license.

And hard to get right

[MacGabhain]

I use a trackball that's controlled by my index and middle finger at home and in my office.
(Yes, I have an office. Neener-neener.)
Most computers have mice.
I can't imagine that the motions of my whole arm for a mouse (or my thumb for the other kind of trackballs) would mimic those of my two fingers closely enough for me to sign anything anywhere that doesn't have the same or similar trackball that I'm used to.

Re:And hard to get right

[mrselfdestrukt]

I also use my index finger at the office and my middle-finger at home most of the time.

How to Sign with a Mouse:

[Sophrosyne]

tape a pen (leaving it's lid on) to the side of your mouse and do your thing!
Maybe some mouse manufacturer will beat the crowd and include a pen like antenna that can be contained within the mouse, or taken out when needed.
Just a thought...

And the problem we're solving was ??

[richg74]

It's not clear to me that this is any more "secure" (in quotes because the context hasn't been defined) than a conventional signature (for example, made with a stylus on a touch-sensitive pad -- these are used by some places here in the US for credit card transactions).

It does, though, raise a related issue which troubles me: is it a good idea to use technology to remove the transaction from the realm of ordinary human experience?

If you use a conventional signature, the person on the other side of the transaction can at least make a gross check that the signatures (as written, and as on the credit card, for example) match. But, if I am understanding this proposal correctly, all the matching occurs "inside the machine". I worry a bit about the unintended side effects of this: "the machine is always right!"

(BTW, I think one has a very similar problem with some of the proposed electronic voting systems. Traditional ballot papers are not perfect, but I think that at least a normally intelligent person can understand the security model.)

Rich
SCO delenda est.

The first step....

[EverDense]

'uses a neural network to pick out the unique features of the way that someone uses a mouse.'

This is the first step along the way to creating the Terminator series of personal assassination cyborgs.
The simple neural network picks out unique features of mouse movements, just like the Terminators
pick out unique faces for termination.

All I can picture is...

[bob670]

my current PHB who can't wait for anything to open or appear on the screen and just clicks/types/mouses incessantly, no matter how large the program or file. I just have a visual of all his email and Words files plastered in his signature.

Big Deal ....

[Anonymous Coward]

I can sign my name in the snow

That's the point though..

[mindstrm]

it doesn't have to look nice.. the software analyzes the way you move the mouse.. so even some else artistically inclined could not necessarily duplicate the way the signature was drawn with any statistical closeness, even if the finished product looked virtually the same.

Re:That's the point though..

[whereiswaldo]

Interesting, but there's a big problem with using a mouse to write a signature: moving from machine to machine. The ergonomics are totally different between machines, for one thing. Plus, different brands of mouse. What about mice with the thumb-rollerball? Or notebook touchpads? Or optical mice vs. crappy old mice with crud stuck in the rollers?

Re:That's the point though..

[essreenim]

Thats the thing:
The software apparently analyses the detailed movemements people have with the mouse. This is not equivalent to signature - this is equivalent to hand-writing analysis - where people try to capture information about you from the way you right. It would contain a wealth of information - perhaps too much. There are privacy issues here.
Do we really want to take a personality test every time we purchase online? :/

Re:That's the point though..

[Anonymous Coward]

if it's really equivalent to handwriting analysis, let's for gods' sakes hope it never becomes common! graphology may not be quite as bad a pseudoscientific superstition as astrology, but it's right up there with polygraphs IMAO.

Purpose of a signature

[semanticgap]

Many (most?) people misunderstand the purpose of a signature.

The purpose of a signature is to be able for you to know that you signed it, not for someone else. I use different signatures at different times, but I know they are mine. To that extent, signing something with a mouse is just fine, for as long as you can tell _your_ signature appart from someone else's.

When a bank caches a check with your signature, they mostly don't look at the signature at all, and if they do, it's only a cautionary measure, since one cannot definitevely compare signatures.

If a thrid party wants to hold you based on your signature, they request a *notarized* signature, which is a whole different thing, because there you sign a document in front of a state-certified witness.

paranoia...

[magarity]

uses a neural network to pick out the unique features of the way that someone uses a mouse

Great... as if I didn't have enough to worry about. Now I have to start more erratically using the mouse so I can't be tracked... except that being completely erratic can be a recognizable trait... ARGH!!!

I've done something like this

[n0nsensical]

When I bought a ticket online from GrooveTickets, I had to sign this Flash applet, although I'm not sure how that alone is going to prevent theft because if someone was trying to use a stolen credit card, I'm sure they wouldn't have much trouble forging a signature on a Flash form with a reset button.

Re:I've done something like this

[Anonymous Coward]

Hmm, using that Flash applet my signature looks a lot like boobies.

Useless? Maybe not ...

[aaronli]

OK, so maybe using mouse movements as a digital signature isn't likely to be much more than an option extra layer of security over the web.

But what about active security of terminals?

If the software could be adapted to analyse the common use of a mouse (or lack there of, I like my keyboard shortcuts too) when using a display then I might be possible to continually verify the person using the display. A failed authentication could result in a screen lock (xlock) an automated log out, account deactivation etc.

Would help stop people joyriding on your screen when you forget to lock it.

What about lefties?

[va1entino]

I write with my left, use a comp with my right.

Mouse change??

[Ummite]

And what happen when you change the mouse driver and the speed of the mouse change, you loose your "unique signature" ? Personally, I've tried once to write in photoshop and I can't beleive I could do twice a signature that look like each other!

Re:Mouse change??

[Anonymous Coward]

And what if you buy a new mouse? I'm currently working with a trackball. What if I want to sign something on the university, where they have regular mice?

Will Belkin make a PS2 adaptor

[Anonymous Coward]

for my pelikan 140?

I didn't think so. Screw 'em...

Screw That!

[msaulters]

Fuck doing that... I'm left-handed, but mouse right-handed. No way in hell I can write a siggy with my right-hand mousing. And I have a hard-enough time doing it with a pen in my left hand. Right-handers: try pushing a pen from right to left across a page sometime while making a legible or artistic mark. My WRITTEN signature isn't the same every time I do it.

I think if they want to truly be able to verify your identity, they'll have to eventually do some kind of real-time video verification where you speak with an operator from an authorized third party who asks you a series of random questions to verify your identity. Then, they'd have an audio-video record of the transaction, and be able to verify it wasn't from a recording/macro/etc.

what about lefties?

[plorqk]

I am a lefty that uses a right handed mouse. This would never work for me because I don't write with my mouse hand nor am I adept with a mouse with my writing hand.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Useless method

[ReyTFox]

I read in the paper(or was it a magazine?) recently that compared digital thumbprint scanners that could be used with a PC's USB port. The prices given for these scanners were mostly in the low $100 range, but the minimum was more like $70. The quality on them was generally good(with the occasional misses, but retrying corrected the problem).

The software they came with didn't seem to have a "signature" feature, just a "password-entry" one, but the technology could probably be applied fairly easily to that sort of endeavor. In a few years or so the price will drop enough so that everyone can afford them, and we won't need this sort of stuff anymore.

Of course, there's the problem of people with no thumbs, or thumbprints(a rare condition), and people who steal thumbs on the black market...but we can deal with that as it comes up :P

Re:... even easier with a pen mouse.

[boredMDer]

Pen shaped mouse, eh? I think we all know what that was used for.

Yeah, but what about ...

[Disco Stew]

... when I'm on *certain* sites where my *other* hand is using the mouse....

cool but pointless

[nudicle]

If I can agree to a contract with a mouseclick (EULA, etc...), speak to a credit card company about "my" account by providing a SSN and a mother's maiden name, and access my banking data online via a password and perhaps some combination of above, I don't see why this is an important innovation as far as the marketplace is concerned. Granted, it's cool and thus I support the intellectual endeavor, but it as well will be rife with security issues of its own. -nudicle

Same computer? Same mouse?

[Anonymous Coward]

Sounds like a good idea, but... I use 3 computers, one with a wireless optical mouse, one with a wired ball mouse, and a notebook with a touchpad.

Undoubtedly, I make different movements with each. So which one gets 'official' me status?

Obligatory Clippy Joke

[AnalogDiehard]

Clippy: It looks like you are trying to sign up for pr0n. Would you like me to retrieve your signature facsimile for the credit card authorization?

Oh great. So now i need to check 2 cables

[hardaker]

That means I not only need to look for keyboard cable keystroke recorders, but I need to start looking for mouse recorders as well?

I have an IntelliMouse..

[E_elven]

..so my 'unique mouse movements' mostly consist of delta-v experimentations within the constraints of the mouse cord (and sometimes, beyond) and some expressly kinetic friction-impact procedures, accompanied by the occasional close-proximity functions by cat hair and various non-blunt objects.

Mouse logger

[Anonymous Coward]

Hhmmm... At last, I have a use for my mouse logger trojan!

John Handcock

[shigelojoe]

He was probably talking about the pornstar. And if there isn't a pornstar named John Handcock, there damn well needs to be one.

A lack of John Handcock is un-American(TM), dammit.

Doesn't sound promising

[jtheory]

A forger would have a hard time copying the variations in speed that the actual person uses even if the forger traces the same path or tries to "get good" at the signature.

The problem is that the actual person may also have a really tough time reproducing the same speeds, patterns, etc. in their signature.

This is why handwriting analysis/comparison is almost always inadmissable in court -- it's too variable.

The reasons for this are especially apparent when you look at the handwriting of people like myself whose fine motor control (like many guys) is not so "fine"... I can type quickly, but my signature varies *widely* each time I sign my name. The slant of the letters in my handwriting, type of loops, etc. also varies depending on my mood, the pen and writing surface, my posture, etc.

My real point here is that there's certainly a future in some kind of online "signature", but I'm guessing we'll end up with a system based more on asynchronous crypto as opposed to some kind of biometrics like this.

Normal hard-copy signatures aren't particularly secure -- no one pretends they are. That's why most of the time the cashier doesn't compare the signatures (in more automated systems like many gas stations, and online, they CAN'T). That's also why we have Notary Publics in the US who will certify that you were the one who marked the paper. The advantage of hard-copy signatures is that they're tough to scam safely, in bulk.

I suspect that most online signature methods *WILL* be comparitively easy to scam in bulk, simply because this is the internet, and it's all just data.

the EULA of the future?

[Low2000]

There has been a lot of talk about how the EULAs of computer software are pretty much void. That simply clicking ?I Agree? means nothing and that the EULA of today wouldn?t stand up in court.

What about the EULA of tomorrow? If, instead of an ?I Agree? button we are presented with a ?Sign Here? white space, and the EULA states that by signing, both people agree that it is a binding contract?

See where I?m going?

But....

[slashhax0r]

I use a trackball...

How advanced is this crap?

[OriginalSpaceMan]

For a second, I thought they meant that this software would watch your mouse moving and clicking habits to identify you. Then I realised that all they want is to be able to draw a stupid unique symbol with a mouse. This just seems to be the dumbest thing in the world. It's not a bad idea, but it's getting hype as if it were some fancy new security technology.

What's up with this?

The security system works with both optical and mechanical mice.

No, really? What if I have a track ball?

dumbasses

Just don't have a stroke...

[tomdarch]

Or a major head trauma for that matter. I know it was high on your 'to do list' for this week, but if your identity is being confirmed by close reading of your fine motor skills, then scrambling your noodle is likely to cause you to not be recognized!

special mouse

[cosyne]

Ok, so the two problems we've pointed out so far are that 1: an attacker can just capture the mouse movements (a problem with any unencrypted data stream), and 2: the signal will vary with the type of pointing device.
If you really want to use a system like this (not that I would), just make a secure uber mouse which forms a secure connection to the mouse drivers (which also do the signature recognition), and require everyone to use that. Then the signature sequence is never seen in the clear unless someone 0wNz your box. Make it a nice, accurate, ergonomic optical mouse, (maybe cordless) so people won't complain that they like X mouse better, and explain that the hardware cost is part of making the security system work. And go ahead and design it to work like a normal mouse when the right drivers aren't there (but then no signature), and put a few megs of mass storage on it to keep a driver installer so you can use the signature software when you need to (again assuming you can trust the box).

This is similar to Morse Code

[sQuEeDeN]

One of the legends of the early radio intelligence (and other classified military radio work) was that each coder (morse that is) had a very specific tapping style that was discernible by a trained professional. Such uniqueness was noticable even if the coder switched hands.

While this uniqueness didn't provide a surefire form of authentication, professionals who feared having a broadcast recognized would sometimes retire a coder after sending a particularly sensitive message.
Seems kinda like mouse analasys. You can't prove it's them, but it's another suggestion. Can't see how it'll be useful. The mouse is easy enough to hook into in the software side--it's by no means a secure device.

This won't work, and here's why:

[rice_burners_suck]

Yeah? What if the mouse on my laptop is a scratchpad, the one in my desktop is a trackball, the one at work is a traditional mouse full of dust, and the one on my buddy's IBM laptop is that red "dot" thingy?

It sounds like this system of verifying stuff won't work in the real world.

Re:... even easier with a pen mouse.

[Anonymous Coward]

Writing important documents in Word?

Trackman Marble SOL I suppose...

[The Lynxpro]

I guess its time (since this sparked my interest) to get a Wacom writing tablet and start taking advantage of the handwriting recognition built into OS X Jaguar... :0

A better (and fannier) one

[vvdd2]

There is a much fannier one (java required). Try it and you will find a lot about yourself

http://www.sitebits.com/2000/SIG/

It is available since 2000.

Re: http://www.sitebits.com/2000/SIG/

[vvdd2]

Try this:

http://www.sitebits.com/2000/SIG/

You will find a lot about yourself.

RSI

[Anonymous Coward]

And how about people like me, who can't use a mouse? I used a mouse a lot, when I was younger, until my hand started hurting like hell.

At least, after a few years of not using a mouse, it has stopped hurting, but I still can't use a mouse without the pain coming back.

Handheld pads too..

[Channard]

Why do people sign electronic pads at stores when they use credit cards? Not just at stores, either. In the UK, at least, one courier uses handheld computer type devices - which electronically capture your signature. All you'd need to do to get an electronic copy of someone's signature would be to package up any old thing in a package, get one of these devices, deliver it, and hey presto.

Re:Handheld pads too..

[Bingo Foo]

Ugh. I hope you were joking.

You don't need to construct, buy, or steal one of those devices and impersonate a delivery man. You could simply send someone a package with delivery receipt requested, and when you get the paper delivery receipt, there's the recipient's signature, in beautiful 1-bit digital glory. Scan it, and what do you have?

Jack squat.

I have the signatures of several very wealthy people "on file." They're called sports autographs. So what?

Glass Table

[hysma]

Every try using an optical mouse on a glass/clear plastic desk? At Future Shop (Canada's version of Best Buy), they had one of those transparent Macs on a matching transparent desk showing off OSX so I gave it a whirl, though the friggin mouse went all over the place!

Get out the packet sniffers

[hysma]

Well everyone, get out the packet sniffers, or if it's encrypted (I hope so!) the memory readers and just take a look at the data this program collected. Transmit that to the site, or however it works, and voila... instant signature of poor Joe Clueless. Even easier than forging a hand written signature!

...lest we forget the lefties...

[uptownguy]

...let's not forget us lefties out there. We are using the mouse at a totally different angle then the righty -- unless, of course, we are forced to sit at someone else's machine -- in which case we can use the mouse but our dexterity isn't what it could be...

Except for those of us who have broken down and always use the mouse on the right side. Not sure what to say about that.

(My personal opinion is that lefties who switch their mouse buttons are just weak and only add confusion to the mix...but it is 4:45am and I am tired, so that is just a cheap shot at fellow southpaws, sorry!)

To get back on track -- I'd hate to see the system not take into account the unique differences that come from the way lefties use their mice. I know I had trouble with handwriting recognition on my PDA until I could use a program like Jot/TealScript to define my own input. I could make the characters like I was "supposed" to, but because of my input angle, I was still having a problem.

Re: http://www.sitebits.com/2000/SIG/

[badisp]

I seen this "mental contamination meter" back in 1999. We tried to use similar java applet technology for signatures, but there was no much interest. Everyone was completelly happy with what they have.

Dumbing Down

[t_allardyce]

All so the next generation of Macs can be shipped without keyboards?

Is anything actually that wrong with typing a password? Its pretty tried and tested, it just seems that these new methods are just trying to look cool.

Also, wasnt there a pen that contained motion sensors that could varify your real signature while you wrote it? It was pretty similar to this except it could detect more things like pressure and angle.

Not really new: http://www.sitebits.com/2000/SIG/

[badisp]

This kind of technology is not really new. Similar approach was tried before for credit card applications, but the problem was that nobody really needed it. Check this link, look at what this technology was finally put at.

http://www.sitebits.com/2000/SIG/

I personally think that such technology can be used for fun and internet amusements, not for real signatures.

Variations in signatures are OK, even good

[G4from128k]

The problem is that the actual person may also have a really tough time reproducing the same speeds, patterns, etc. in their signature.

That is the entire point of a modal analysis of the signature. It captures not only the central tendency of the signature, but also the characteristic modes of variation. The idea is that everyone's signature varies in amounts and ways that are unique to that person. Some people might vary more on the first letter, the heights of letters, the shapes of loops, slant, the spacing where the hand scoots over, etc. Analyzing a population of samples from the person gives the system a good idea about what parts of the signature vary, how they vary, and how much they vary.

The reasons for this are especially apparent when you look at the handwriting of people like myself whose fine motor control (like many guys) is not so "fine"

Like you, I too was born without an analog plotter interface. A person like myself or jtheory will simply get logged by the system as being more variable than a person like Ms. Ima Caligrapher. If a forger or mouselogger tries to replicate our signature, they will be flagged as being too perfect.

MouseAlternatives?

[muffen]

I use a trackball at work, and a mouse at home. Try replicating the movement between the two, and you'll see how different they are.

Unless you are forced to use a mouse (not trackball, pen or weird device stuck to your head), this won't, IMHO, really work.

Unix

[Anonymous Coward]

But i am a hard core *nix guy
i dont use a mouse !

Mouse type

[danila]

Does that depend on the equipment used? Different mice have different characteristics. I am sure that there are still some recurring patterns, but will this software be able to recognize my signature, regardless of whether I am using an optical mouse, expensive mechanical mouse with heavy ball, clunky 5-button mouse, small cheapo "Noname" (tm) mouse with light plastic ball, gaming mouse, ergonomic mouse, etc?

Weird left-handed people

[Rui Lopes]

I'm left-handed but i use my mouse with the right hand... I know it's weird but I can't sign my name with the right hand. I guess the solution ain't solution to everybody!

A mouse is not a trusted device.

[Anonymous Coward]

And never will be.

Can you imagine if it authenticated every movement with a remote server?

And even if it did, we can still fiddle with the mechanics of it.

In a traditional ball-based mouse, just wire the optical sensors to another computer generating the movement pattern.

Even a trusted, self-certificating wireless optical mouse isn't that trustable. Attach any mouse to the head of an architect's A3 plotter and you can make it perform whatever sequence of movements you like -- a mouse dancing the Bolero, anyone?

NT

Man in the middle

[SLOGEN]

This places everyone who ever accepts a signature from anther person in a position to man-in-the-middle attack that person, pretty clever.... DUH!

What is needed in computer-systems is zero-knowledge proofs, or at least a challenge/response method influenced by both parties.

The real use for bio-metrics is to verify relations between identity and private-key possesion in a trusted 3rd-patry setting, not for authentication itself.

Wonderful

[cr@ckwhore]

"It's about using the mouse as a kind of surrogate pen," said Dr McOwan.

Wow doctor! What a fucking revelation! This just in ... I've discovered a way to draw perfect circles using a mouse. Holy shit... it'll change the world.

Sometimes, I get the feeling that I'm surrounded by idiots. Oh wait a minute... I AM!

Digital Signature Capture

[CrazyTalk]

I work with digital signature capture for handheld computers. Not only is the bitmap image stored (which would be easy to reproduce and forge) but so is the the way the signature was written in the first place - pen stroke length, order, etc. There are other security factors in place as well. Presumably, a similiar system will be used to ensure security in mouse-driven signature capture software.

Ghost Mouse 6.2 to be fined a billion dollars!!!

[quartzzk]

Simply put, GM6.2 could very easily be fined as forging a billion signatures too.

Click-wrap EULAs?

[yerricde]

Would just clicking "I Agree" to a contract displayed in a scrolling read-only textarea be considered "well-recognized in society that going through this specific ritual means entering an agreement"?

Non-portable signatures.

[John Allsup]

If you're sat using the same computer with the same mouse and the ball's not getting dirty, etc.
then it may well work ok.

But, you cannot, e.g. sign something when using a friends laptop if there isn't a mouse attached. You can't sign if the mouse is dirty and jumps around a little.

I bet the 99% accuracy was when using identical equipment for each of the test 'signings'.

trackball

[scovetta]

I've got a trackball. After 3 years of using it, I still can't draw anything that even resembles what I want it to be. Of course, I can't draw with crayon or pencil either.

As a left-hander..

[troezen]

..who writes using my left hand but uses the mouse right-handed, trying to write a signature with the right hand yields a result somewhat similar to what a two-year-old can draw with a pen in her mouth.

Turing test

[FesterDaFelcher]

How about the computer asks the forger, er human some turing test questions? It could be a 30 minute test, and if it decides you are a human, then you can enter your 4 digit pin number.

Mouse!?!

[ecloud]

So a mouse would be required for ecommerce then? There are so many other input peripherals, many of them are better in some way for some people at some times, and we shouldn't have apron-strings tied to one input method that ought to be obsolete by now anyway. Well, maybe if the software works equally well with pens, it would be somewhat better...

And the other problem is that the software might not run everywhere. The best they could do is use Java, and that's also a pain.

We should be using smartcards or DalSemi iButtons for ecommerce. (Perhaps a PIN or password should be required too.)

Teaching about passwords is "easier"?

[ianscot]

And the other obvious question : wouldn't it be easier to simply teach people why they should use properly formed passwords that are not "mom", "dad", "john1" or "s00persekrit"?

Hmm. Why don't we ask the couple of generations of IT people who've tried to teach people this very lesson? Maybe they have something to say about that one. I could start with our call center: their number one call every month for the last five years has been "Please reset my password" despite several "education" campaigns.

People don't use "bad" passwords because they're uneducated nitwits, they do it because there are so many dang systems asking for passwords that they'd be driven crazy by the exercise of keeping them all straight otherwise. Either that or they'd have to write 'em all down, which kind of defeats the purpose, yes?

This motion signatures thing probably isn't the solution -- but hey, at least it does try to build on a model users know. Existing ID and authentication methods do sort of suck, so it's not like this is a solution without a problem.

All digital security is just an arms race

[LilJC]

Defense: Check mouse movements
Offense: Record and playback
Defense: Check for exact replica
Offense: Add slight differences
Defense: Check slight differences for consistency with original behavior
Offense: Analyze movement to make differences consistent with recorded macro

This sort of thing goes on and on - reminds me of using a sharpie to circumvent the null data track on copyrighted CD's.

The bottomline is that there is no real security. Even the number of bits in encryption has to be bumped as processors speed up to try to keep them from being crackable in a timely manner. Suppose encrypted credit card transcactions are being logged by someone, with only the last 3 months being kept on file. If there's a huge breakthrough with a diamond superconductor processor, the attacker can assume that most of the credit cards logged in the last few months haven't expired, crack them fairly quickly (even at a day per card), and go on a shopping spree.

The only way to never be behind in an arms race is to never start one, unfortunately this means no steps can be taken for security.

Perhaps a better answer is to start with a system already a few steps ahead of the "offense" from the word go, discouraging attempts to circumvent it. Of course this tends to be costly to develop and (with computers) processor intensive to use.

Point of failure: Cleaning/replacing the mouse...

[inimicus]

Hurm... So, if the basic idea behind this is to profile the mouse usage, how will it react when a gummed-up mouse is cleaned? Or with a new mouse? Much better chance of working with an optical, I expect, but even then, won't there be jumps and jitters in mouse-movement if the surface is changed?

death to the system!

[luckyguesser]

logging onto pharmacy website to get my pain killers... but wait, my hand is in a cast! Let me try my left hand! Wait, I'm right-handed; my left will never work! ....

Re:... even easier with a pen mouse.

[KenSeymour]

I use a WACOM tablet. It has a pen and there is good support for them under Linux and XFree86.
They are pressure sensitive as well.

And they are much easier to draw with than a mouse, so signing your name would be much easier.

...and the ambidextrous

[metamatic]

Then there are people like me, who go both ways :-) I use my left hand to mouse with at work, and my right hand at home.

To add to the unlikelihood of this "mouse signature" system working, I use a trackball at home, a mouse for the laptop, and a trackpoint sometimes as well.

Signature Smignature

[ralico]

I'm worrying about the retinal scan and blood sample.

Re:Signature Smignature

[oldskool69]

The next big thing in biometrics: the piss test signature! Your own personal bouquet is chemically analyzed and stored electronically. Then, when you need to make a purchase or sign for a package, just piss on it.

Of course, should any unauthorized substances be detected, the fine will be conveniently included on the bill, and a detective squad will be dispatched with a search warrant to your home address.

...and the furries

[Anonymous Coward]

They don't even have hands, only paws. Or at least they wish they had paws.

A left-hand & right-hand THUMB . . . .

[vortexau]

. . . PRINT sensor on the side of Mice!

What do you think -- a Thumb-print Sensor on the side of the mouse?
There might have to be both L-H & R-H versions.
.

AnonyMouser

[dogboxdweller]

Well, there's an opportunity just begging for some of you clever EFF types to leap on it and savage its little mousey carcass.

Distribute a piece of software that randomly manipulates your mouse so that we can all be anonymouse once more.

Get to it, you freaks!
+++

More to it than that

[LR_none]

The U.S. E-sign legislation requires that

• All parties agree to accept a given digital gesture as a valid signature;
• The entire text of the agreement that was digitally executed be preserved in verifiable original form; and
• The original executed document can be reproduced on any signer's request in a reasonable amount of time.

In practice, the form of the signature is the least onerous requirement. A simple "I AGREE" button is as legally valid with or without a sophisticated PKI signature, e.g., from VeriSign or Thawte. Entities that want to offer legally binding digital agreements spend much more time focusing on the storage and retrieval requirements.