Slashdot Mirror
Sign Your Name Online With A Mouse
icke writes "Soon, the way you use your mouse could help prove who you are. According to a BBC News article, scientists have found a way for people to sign their name online using a mouse instead of a pen. The technology, based on the research from Queen Mary College, University of London by Peter McOwan, 'uses a neural network to pick out the unique features of the way that someone uses a mouse.'"
To get ink from a mouse? Yeesh.
C - A language that combines the speed of assembly with the ease of use of assembly.
You could just record the mouse movements with some macro software and then play it back whenever it asks for their signature.
Everyone that disagrees with me is a paid shill
Would a signature created with a mouse be legally-binding?
Vertical motions detected. Credit authorization failed.
Thank you for shopping at Victoria Secret.
Banaaaana!
...I know all the kbd shortcuts and rarely use my mouse....err... ...You Insensitive CLOD!
While it may be a huge flourish that impresses the ladies, your signature is not as secure as it would seem. Forgeries are easy to make by skilled criminals.
Use a cryptographic key to sign. You'll be glad you did.
And what happens when you change to a different type of mouse? My change to wireless optical was quite a change which took some getting used to, and I'm sure it didn't "sign" the way I used to. Or whatever. :)
Until you get a wireless mouse. I've got one of those expensive Logitech mice, and even then, it moves erratically without warning. Not exactly good for predictable signatures, if you ask me.
My girlfriend had a pen-shaped mouse for a while, (wrist problems), and I'd imagine signing would be much more "natural" with one of those. Neat idea, though ...
David.
...and probably easily replicable, since an actual physical presence is unneeded, and the ability to play back a "mouse stroke" will be a capable feat by any second year CS major.
Just what I need. Computers to tell me I'm not me when I sign my name. At least with people I could make a convincing argument.
What about if you change your mouse type to something like a trackball or a laptop mouse? Your signature wouldn't work anymore, and you cannot access anything from other computer!!!
I don't think this will take off. Ever tried signing your name with your mouse? Reminds me of pictures I'd draw and put my name on when I was 4. When I use my credit card in person, each and every time I sign it differently so it DOESN'T match the signature on the back of my card just to see if anyone says anything. No one says a word. Even got away with signing "Blooooopy!" and no one noticed (no, my name is not Blooooopy!) If existing methods are trivial, how would this method work?
We have secretly replaced these Slashdot mods' sense of humor with a rusty nail. Let's see if they notice!!
Will I have 3 signatures since On this box I have a trackman that I prefer to use. Sitting right beside me I have a standard old mouse and at work I have an optical mouse. All three take time for me to get used to again each time I switch. I have to assume that it's because I'm using them slightly differently, due to the feedback. As well if I change something like the mouse acceleration because things seem to slow one day It takes awhile for me to come back into practice. How Do they deal with these changes?
Because I always use a mouse the same way, this will work great.... Not. I have many different computers, all with different types of mice and software. Trackballs, eraser-head laptops, trackpad laptops, and don't even get me started about different operating systems and the software they use. This is not going to work for many reasons, and I hope business realize this sooner than later.
Signatures are useless, there are no good way to check them. Hell, my signature seems to change every time I write it and nothing happens. The mouse signature will be at least slightly secure if there is software to check it. It would really be best if we switched to a differnt system for this kind of stuff. Thumb print or something. I know you can reproduce someone's thumb print, but it's not THAT easy.
"It's another way of indicating that you as an individual are sitting there on the end of the line."
Easy to fake with a mouse movement recorder.
Oh and what about people who use a trackball? does the smart biometric layer apply to those hand movements?
And the other obvious question : wouldn't it be easier to simply teach people why they should use properly formed passwords that are not "mom", "dad", "john1" or "s00persekrit"?
In short, yet another far-fetched solution to solve a non-problem.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
After recently studying for the CISSP, I learned a great deal about biometrics. The most accurate biometrics include things like iris scans, palm scans, retina scans, etc. These are so accurate because they measure characteristics that are totally unique to individuals. Signature dynamics and keystroke dynamics are some of the most ineffective biometrics around. A big problem is they can be faked. While the article states that early trials are 99% accurate, it doesn't detail how many people have actually tried this system. (A test group of 10 wouldn't be very good.) It also doesn't mention if they tried to fake it out. The real world is a harsh place on biometrics.
--
Luck is just skill you didn't know you had.
it's just ms paint with a web front end and a bunch of offshore labourers visually verifying each one !!!! ! !!
it's 99% accurate because of carelessness and post-lunchbreak bloat factor
I use everything from a mouse to a touchpad to a roller ball.... is my signature the same using all of these things?
How will it know? I'd get really annoyed if I had to plug in a mouse on my laptop to sign for something.
-n-
This looks like a variation on what the folks at Cybersign do. Their technology is based on matching the dynamical pattern of motion, not just the X-Y coordinate trace. A forger would have a hard time copying the variations in speed that the actual person uses even if the forger traces the same path or tries to "get good" at the signature.
Two wrongs don't make a right, but three lefts do.
So the "signature" is tied to a specific pointing device...
so your signature is invalid if you use a laptop with a trackpoint,touchpad, or use a track ball or a tablet and a pen, etc.....
Neat idea, 100% useless in the real world.
Now if you can get a reliable identifier (How about something as simple as a ibutton ring (www.ibutton.com) and quit trying to invent the unique personal identifier that so far is only out DNA (no, no dna testers on our computers than you.)
Identification has always been tied to a unique card, number, whatever given out by a group or agency. Why not stick with the same thing just update it with current off the shelf technology that already works?
www.ibutton.com I use it to log into my computers at home, unlock my doors and even start my harley....
Do not look at laser with remaining good eye.
what about the mice that are controlled with your thumb, you know the ball that you move. i doubt it would work well with one of those mice
What is slashdot?
+5, uses neural network technology
+2, academic researcher
+2, academic researcher studying biologically inspired hardware and software
+1, biometrics
+1, researcher teaches multimedia
+2, researcher teaches computers in society
+2, no history of employment in real world
-1, degree in physics
------------------
+14, almost certainly bullshit
Doesn't it make you feel good to know that our freedoms are protected by politicans, lawyers and journalists.
Christ... first thing I did when I read that was stop moving my mouse.. then the thought crossed my mind that by doing that, I was just setting up a new signature, so I started moving the mouse. Then, I started to think that maybe I was moving the mouse in my own special way, so I tried to make something up.
Then it occurred to me that I'm using lynx.
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
It does, though, raise a related issue which troubles me: is it a good idea to use technology to remove the transaction from the realm of ordinary human experience?
If you use a conventional signature, the person on the other side of the transaction can at least make a gross check that the signatures (as written, and as on the credit card, for example) match. But, if I am understanding this proposal correctly, all the matching occurs "inside the machine". I worry a bit about the unintended side effects of this: "the machine is always right!"
(BTW, I think one has a very similar problem with some of the proposed electronic voting systems. Traditional ballot papers are not perfect, but I think that at least a normally intelligent person can understand the security model.)
Rich
SCO delenda est.
my current PHB who can't wait for anything to open or appear on the screen and just clicks/types/mouses incessantly, no matter how large the program or file. I just have a visual of all his email and Words files plastered in his signature.
uses a neural network to pick out the unique features of the way that someone uses a mouse
Great... as if I didn't have enough to worry about. Now I have to start more erratically using the mouse so I can't be tracked... except that being completely erratic can be a recognizable trait... ARGH!!!
When I bought a ticket online from GrooveTickets, I had to sign this Flash applet, although I'm not sure how that alone is going to prevent theft because if someone was trying to use a stolen credit card, I'm sure they wouldn't have much trouble forging a signature on a Flash form with a reset button.
He was probably talking about the pornstar. And if there isn't a pornstar named John Handcock, there damn well needs to be one.
A lack of John Handcock is un-American(TM), dammit.
A forger would have a hard time copying the variations in speed that the actual person uses even if the forger traces the same path or tries to "get good" at the signature.
The problem is that the actual person may also have a really tough time reproducing the same speeds, patterns, etc. in their signature.
This is why handwriting analysis/comparison is almost always inadmissable in court -- it's too variable.
The reasons for this are especially apparent when you look at the handwriting of people like myself whose fine motor control (like many guys) is not so "fine"... I can type quickly, but my signature varies *widely* each time I sign my name. The slant of the letters in my handwriting, type of loops, etc. also varies depending on my mood, the pen and writing surface, my posture, etc.
My real point here is that there's certainly a future in some kind of online "signature", but I'm guessing we'll end up with a system based more on asynchronous crypto as opposed to some kind of biometrics like this.
Normal hard-copy signatures aren't particularly secure -- no one pretends they are. That's why most of the time the cashier doesn't compare the signatures (in more automated systems like many gas stations, and online, they CAN'T). That's also why we have Notary Publics in the US who will certify that you were the one who marked the paper. The advantage of hard-copy signatures is that they're tough to scam safely, in bulk.
I suspect that most online signature methods *WILL* be comparitively easy to scam in bulk, simply because this is the internet, and it's all just data.
There are only 10 types of people: those who understand decimal, those who don't, and, uh, 8 other types I forget.
There has been a lot of talk about how the EULAs of computer software are pretty much void. That simply clicking ?I Agree? means nothing and that the EULA of today wouldn?t stand up in court.
What about the EULA of tomorrow? If, instead of an ?I Agree? button we are presented with a ?Sign Here? white space, and the EULA states that by signing, both people agree that it is a binding contract?
See where I?m going?
One of the legends of the early radio intelligence (and other classified military radio work) was that each coder (morse that is) had a very specific tapping style that was discernible by a trained professional. Such uniqueness was noticable even if the coder switched hands.
While this uniqueness didn't provide a surefire form of authentication, professionals who feared having a broadcast recognized would sometimes retire a coder after sending a particularly sensitive message.
Seems kinda like mouse analasys. You can't prove it's them, but it's another suggestion. Can't see how it'll be useful. The mouse is easy enough to hook into in the software side--it's by no means a secure device.
Recursive (adj.): see 'Recursive'
Interesting, but there's a big problem with using a mouse to write a signature: moving from machine to machine. The ergonomics are totally different between machines, for one thing. Plus, different brands of mouse. What about mice with the thumb-rollerball? Or notebook touchpads? Or optical mice vs. crappy old mice with crud stuck in the rollers?
There is a much fannier one (java required). Try it and you will find a lot about yourself
http://www.sitebits.com/2000/SIG/
It is available since 2000.
...let's not forget us lefties out there. We are using the mouse at a totally different angle then the righty -- unless, of course, we are forced to sit at someone else's machine -- in which case we can use the mouse but our dexterity isn't what it could be...
Except for those of us who have broken down and always use the mouse on the right side. Not sure what to say about that.
(My personal opinion is that lefties who switch their mouse buttons are just weak and only add confusion to the mix...but it is 4:45am and I am tired, so that is just a cheap shot at fellow southpaws, sorry!)
To get back on track -- I'd hate to see the system not take into account the unique differences that come from the way lefties use their mice. I know I had trouble with handwriting recognition on my PDA until I could use a program like Jot/TealScript to define my own input. I could make the characters like I was "supposed" to, but because of my input angle, I was still having a problem.
I would have to say that explosives are the most abused technology in all of history.
The problem is that the actual person may also have a really tough time reproducing the same speeds, patterns, etc. in their signature.
That is the entire point of a modal analysis of the signature. It captures not only the central tendency of the signature, but also the characteristic modes of variation. The idea is that everyone's signature varies in amounts and ways that are unique to that person. Some people might vary more on the first letter, the heights of letters, the shapes of loops, slant, the spacing where the hand scoots over, etc. Analyzing a population of samples from the person gives the system a good idea about what parts of the signature vary, how they vary, and how much they vary.
The reasons for this are especially apparent when you look at the handwriting of people like myself whose fine motor control (like many guys) is not so "fine"
Like you, I too was born without an analog plotter interface. A person like myself or jtheory will simply get logged by the system as being more variable than a person like Ms. Ima Caligrapher. If a forger or mouselogger tries to replicate our signature, they will be flagged as being too perfect.
Two wrongs don't make a right, but three lefts do.
Hmm. Why don't we ask the couple of generations of IT people who've tried to teach people this very lesson? Maybe they have something to say about that one. I could start with our call center: their number one call every month for the last five years has been "Please reset my password" despite several "education" campaigns.
People don't use "bad" passwords because they're uneducated nitwits, they do it because there are so many dang systems asking for passwords that they'd be driven crazy by the exercise of keeping them all straight otherwise. Either that or they'd have to write 'em all down, which kind of defeats the purpose, yes?
This motion signatures thing probably isn't the solution -- but hey, at least it does try to build on a model users know. Existing ID and authentication methods do sort of suck, so it's not like this is a solution without a problem.
"Fundamentalism" isn't about divine morality. It's about human authority.
Offense: Record and playback
Defense: Check for exact replica
Offense: Add slight differences
Defense: Check slight differences for consistency with original behavior
Offense: Analyze movement to make differences consistent with recorded macro
This sort of thing goes on and on - reminds me of using a sharpie to circumvent the null data track on copyrighted CD's.
The bottomline is that there is no real security. Even the number of bits in encryption has to be bumped as processors speed up to try to keep them from being crackable in a timely manner. Suppose encrypted credit card transcactions are being logged by someone, with only the last 3 months being kept on file. If there's a huge breakthrough with a diamond superconductor processor, the attacker can assume that most of the credit cards logged in the last few months haven't expired, crack them fairly quickly (even at a day per card), and go on a shopping spree.
The only way to never be behind in an arms race is to never start one, unfortunately this means no steps can be taken for security.
Perhaps a better answer is to start with a system already a few steps ahead of the "offense" from the word go, discouraging attempts to circumvent it. Of course this tends to be costly to develop and (with computers) processor intensive to use.
The only thing more dangerous than a file named -rf is renaming it -rf\ /