Entering Passwords Through Eye Movement

Stu Dennison writes "Ars Technica has a post up on a new service called EyePassword. EyePassword is a system that attempts to mitigate the issues of shoulder-surfing via a novel approach to user input: no hands required. With EyePassword, a user enters their password using an on-screen keyboard that detects the orientation of their pupils. From the article: 'The gaze-tracking system functions by shining an invisible infrared beam on a user's face. The beam produces a tiny reflection in the eyes that stays put, no matter where a person looks (provided they do not move their head too much). By tracking the stable position of this reflection and the relative position of a person's pupils, the system is able to calculate which keys or buttons a user wishes to input, and interpret the information accordingly ... more than 80 percent of those tested preferred the EyePassword method. Additionally, when testing EyePassword input using an input method where users visually "dwell" on the characters they wish to input, error rates were comparable to keyboarding.'"

Comments

My luggage....

[Deltaspectre]

Only password I'll use from now on is

up up down down left right left right wink blink

Re:My luggage....

[antdude]

Up up down down left right left right wink blink? That's amazing! I've got the same combination on my luggage! ;)

Note: Quote modified from Spaceballs movie.

Re:My luggage....

[Anonymous Coward]

Stealing a joke off a crippled woman, you should be modded -1 shameful.

Re:My luggage....

[antdude]

What woman? We have women here? [grin]

Re:My luggage....

[Jarik_Tentsu]

I'm blind you insensitive clod!

Shoulder surfing isn't the problem

[Myria]

"Shoulder surfing" is usually not the problem. The more common case for stealing passwords is getting a keylogger.

First eyelogger release in 3, 2, 1...

Re:Shoulder surfing isn't the problem

[TheRealMindChild]

The obvious solution is to create an SSH session between the keyboard and the controller.

Re:Shoulder surfing isn't the problem

[anilg]

Ahh... I await the day cryptography can make coffee and drop kids to school..

Re:Shoulder surfing isn't the problem

[smallfries]

Why is that the obvious solution? Are you mistaking what is required for privacy and what is required for authentication?

Re:Shoulder surfing isn't the problem

[Goaway]

Why would anyone make a logger for something nobody uses?

Re:Shoulder surfing isn't the problem

[davester666]

Wouldn't this make shoulder surfing easier? You need to display the keyboard onscreen, large enough to be able to determine which specific key/area of the screen is being viewed, with some sort of feedback indicating that a character has been accepted and which character was accepted [did it accept 'j' or 'k' just now].

as opposed to what?

[clarkn0va]

more than 80 percent of those tested preferred the EyePassword method

...over the "PeeingOnALargeKeyboard" method.

db

Hmm

[Anonymous Coward]

Maybe a bit clumsy for double letters, punctuation and so on. Maybe additional password policies that would usually decrease security would have to be adopted.

Re:Hmm

[derfy]

Nah, just turn on StickyEyes. Blink 5 times in a row to turn it on.

Re:Hmm

[Konerak]

Nice for people who don't know where their keys are.. every time they check, they type.

And try looking at CTRL-ALT and DEL at the same time :)

Konami Code

[Ethanol-fueled]

I wonder if the Konami Code could be adapted to this?

More eye strain typing your homework than reading

[ZeroNullVoid]

More eye strain typing your homework than reading the gosh darn book.
IR, isn't that bad for your eyes?
IR  isn't that bad for your eyes!
IR  is         bad for your eyes.
IR, is    that bad for your eyes?

I have a headache....

An idea

[g1zmo]

Maybe REM sleep could be used as a random number generator.

Re:An idea

[rts008]

I have a recurring nightmare, you insensitive clod!...There's nothing like always rolling snake eyes to make you believe in Demon Murphy!

Re:An idea

[owlstead]

I think you are confused, it's Rapid Eye Movement, not Random Eye Movement.

Re:An idea

[asCii88]

And people can then read your dreams

Re:An idea

[zen-theorist]

Maybe REM sleep could be used as a random number generator.

nope, i dream about naked girls all the time.

Please replace my mouse!

[trawg]

I hope it can be made quite accurate; I've often thought something like this would massively increase my productivity - I'd love to be able to perform tasks without having to take my hand of the keyboard to use the mouse. If I could look at an area of the screen and just hit a key to left/right click it'd make a lot of my common mouse tasks obsolete.

Re:Please replace my mouse!

[Anonymous Coward]

Why would you have your hands on the keyboard when you can control your web browser with your eyes?!!!

As they say: two hands are better than one!!

Re:Please replace my mouse!

[bluej100]

I absolutely agree. It's not like I'd stop using my mouse entirely, but, say, "Focus follows gaze" would save me from a lot of stupid mistakes like sending :q to my boss instead of Vi. It'd also be great for HTML forms. Obviously, there are issues to be dealt with, but I would love to, whenever I'm typing, have it automatically go where I'm looking.

Re:Please replace my mouse!

[Anonymous Coward]

without having to take my hand of the keyboard

That makes me wonder where the other hand is. Wait, don't tell me, I don't want to know...

Re:Please replace my mouse!

[Bloke down the pub]

I'm David Blunkett, you insensitive clod!!!!

Re:Please replace my mouse!

[Anonymous Coward]

I bet it'd be quite cool in shooter games too, provided they can track your eyes well enough to see the difference between a headshot and 'a shot in that general direction'.

head has to stay still?

[DTemp]

Great! Now I won't be able to access my email when I'm drunk!

Re:head has to stay still?

[Solra Bizna]

Great! Now I won't be able to access my email when I'm drunk!

You say that like it's a bad thing.

-:sigma.SB

Hey Linux Devs pay attention...

[B5_geek]

I would gladly donate my left kidney to the person who makes this available for "focusing" the active window.

I LOVE the evolution of "Focus Follows Mouse" but dammit even my Fluxbox isn't fast enough to keep up with where I am looking.

Re:Hey Linux Devs pay attention...

[C R Johnson]

How about a KVM switch that works this way?

I've been wanting one of those for a while.

Re:Hey Linux Devs pay attention...

[Thing 1]

? -- Kidney Video Mouse?

Too bad it can easily be hacked...

[Datamonstar]

... by a pair of boobies just out of peripheral view.

Re:Too bad it can easily be hacked...

[Anonymous Coward]

alternative hack

Re:Too bad it can easily be hacked...

[Tablizer]

I think those who modded me to hell misunderstand that I intended that one *looks* at T&A, not types it on a keyboard.

Truly More Secure?

[excelblue]

Is this eye-tracking truly more secure than simply typing on the keyboard? Although you can look over one's shoulder, you can also look at their eye movements. All you have to do is be in a different position. I suppose with a bit of training, one can figure out the eye movements too. Also, since it's slower, it might actually even be easier to read the eyes than the keyboard. People have mastered lipreading, so why won't they master this?

Also, what would happen if your eyes happened to stray while entering a password? You can never be sure that you're hitting the right keys. The sure only option is to start over if you lose focus. Because there are no keys to guide your eyes, you have to approximate everything. This will take some training.

Re:Truly More Secure?

[josh washington]

Or instead of lipreading, what about video-conferencing?

While the webcam is still going, simply record the video stream and trick the person into surfing to a site needing a password.
Ask them to check your MySpace or send them an Email to read after you've got them on webcam. Or ask them to check your eBay auction from their account..the possibilities are endless.

Kind of like a keylogger, but much so more simple and convenient in my opinion.

Re:Truly More Secure?

[slash.duncan]

The problem for the cracker, however, is that they'd have to have two vantage points at once, one watching the eyes, the other watching the virtual keyboard the eyes were focusing on, to get a position reference on it. Otherwise they'd have roughly the same problem as pupil tracking without the reflected spot, no reference fix. Was that movement a single letter, or to the other side of the keyboard, or somewhere in between? Just observing the eyes could certainly significantly cut down the brute force search space, thereby equally weakening the strength of the password, but it'd be anything but a one for one correspondence. (The reason the software doesn't have this problem is because it is aware of the relative position and size of the virtual keyboard onscreen.)

One could even deliberately reposition the virtual keyboard after every number of characters, as well, thus further throwing off third party eye monitors.

What TFA didn't mention, however, even tho it compared with keyloggers, is that presumably this would replace typed input as just another type of input device. As such, one may not even have to modify the keylogger to have access to the character input stream from the eye input device driver, just as it does from the keyboard device driver. A keylogger generally logs the character input stream, not the raw symbol stream, and the character input stream remains the same, no matter what device it's from or how exotic it may be. The only way around that would be a custom vertically integrated application that handles the entire stack monolithically, instead of as components tying into the conventional input stack. That'd be a huge implementation and portability headache, as it would have to be custom developed for each hardware and software combination implementation. Possible, yes, in embedded or limited hardware/software situation such as (say) ATMs, but not generally deployable without running into the conventional keylogger trojan challenges everyone else faces.

Duncan

Re:Truly More Secure?

[cp.tar]

What I want to know is, when you're already scanning someone's eyes with an infra-red beam, why not just scan their retinas and get it done with? No passwords to remember, and the tech should be quite similar... right?

Re:Truly More Secure?

[DigitAl56K]

You know what's interesting? This doesn't actually solve the problem of shoulder surfing. It just means that an attacker needs to be in front of you instead of behind you. What makes it even worse is that the same technology that can follow your eye movements can be used by an attacker to automatically record them. Just set up a camera that waits for the IR beam to come on, then using a telescopic lens have some software run exactly the same algorithm as the users local terminal.

Anyway - I have a bigger question: Who the hell needs this stuff?! Can you not trust your coworkers? Is your box not sitting right under your desk where they could hack it at night anyway? Aren't you on the same LAN as them? Couldn't they just use a network based attack to root your box?

Unless you work for the NSA a keyboard ought to do just fine.

Re:Truly More Secure?

[smallfries]

So what you're saying is that it can be defeated by building some custom hardware and installing it in the physical location.... oh, much like a keylogger I suppose. So try again, why doesn't this defeat shoulder surfing - the casual swiping of passwords by people who just happen to be in the area.

Re:Truly More Secure?

[ls671]

Well, I assume you could mix-up the digits or code to be entered on the display at login time. You would then need two view points to capture everything. One at the screen and one at the user eyes. A lot of digital door looks where you have to enter digits to get in already work that way. They have LEDs behind the keys to display the digits and every time time you need to get in, you need to press different keys because the digits you need to enter have changed location on the keyboard.

I hate on-screen keyboards :(

[saikou]

While it's probably nice for user that types in something like MyDogSkip as a password, typing in something location based (for example njio1357vgyu) is way more complicated. Which makes entering "hard" passwords extra-extra hard. Instead of muscle-memory you need to use your mouse to do it "one lick at a time". Yuk.

Re:I hate on-screen keyboards :(

[Anonymous Coward]

You'd just have to find other ways to generate hard passwords that are easy to remember than by the position of the keys on the keyboard, rather obviously since you're not using a keyboard. "Three half-circles from zero to 180 degrees, three half-circles clockwise from 270 degrees to 90 degrees, movement code for Shoryuken in Street Fighter 2" might be a suitable password in this system.

It's interesting whether using a system like this would cause most people to generate weaker or stronger passwords, though. It could go both ways; on one hand, there are probably no more than nine different symbols to use and there are obvious patterns(circles and partial circles, concatenations of directions and the direction opposite them), but on the other hand, there's no possibility of entering "password" or your girlfriend's name as the password.

Blind people are screwed I guess

[GodsBlood]

and I don't see the likes of a Michael J Fox or Muhammad Ali using this any time soon.

Re:Blind people are screwed I guess

[Dachannien]

Stephen Hawking: Screw them.

How would I

[RandySC]

then read the PostIt note attached to my monitor with the password written on it if that action will mistype my password?

Stuck in a loop and locked out!

Debit Card Pins?

[Anonymous Coward]

What about at places that accept debit cards. Wouldn't this be ideal for that?

Locked accounts at a model convention

[cheros]

If you're easily distractable I guess it'll prove a cha - ooh, nice legs ...

Two words

[Poromenos1]

Keyboard shortcuts.

digital camera shoulder watching

[gsmb]

I would love to test this using a digital camera. You can try 'looking' at the remote ir light yourself by just pointing the camera to it. I imagine if one was to setup a digital movie camera you may well be able to 'see' the ir beams hitting the monitor. kinda more 'security through obscurity'?? Assuming this can work or be adapted (hacked?) to work what of all the 'online security cameras?' puts a new spin on googledorks....

Re:digital camera shoulder watching

[slash.duncan]

You obviously didn't RTFA. The IR beam and its reflection simply serves as a lock on the positioning of the eye in space, allowing a /relative/ comparison of the position of the pupil. Thus the reflection of the IR beam gives you nothing on its own. Even filming the motion of the eye won't give you an absolute fix on the password (tho it could significantly narrow the brute force search domain), since it's looking at a virtual keyboard to do its "typing", and you'd have to have a fix on where that is as well, in ordered to know whether the movement was a single key or a whole keyboard away.

To make things harder, one could even shift the position of the virtual keyboard every number of characters entered.

Of course, this doesn't solve the trojan keylogger issue at all (despite what TFA says), since the device driver would presumably enter characters into the same input buffer as a conventional keyboard would. It'd therefore arguably help against shoulder surfing in controlled installations such as ATMs, but couldn't do a thing to secure braindead joe user's passwords, with its hundreds of trojan/spyware/malware installations, because braindead joe simply doesn't have the motivation to care enough about such things to invest the necessary time to defend himself from them, and is in fact quite comfortable in his braindead state, blaming everyone /else/ for the problem.

Duncan

shift key?

[toQDuj]

I hope they have an expanded keyboard, so I don't have to abandon most characters and upper-case characters.

I think that's the strength of my password: people can see what I type if they can remember fast enough, but not really understand which character I type in combination with shift ;).

B.

But still passwords!

[mcrbids]

Anybody running an ssh server on a public-facing network that pays any attention at all to their log files knows the problems of passwords.

The short answer is: they suck. All of them. They are easily compromised and have multiple points of failure: ANYTHING between the human side of the input device and the hash function can be hacked to completely defeat the system.

In this case, a web-cam (commonly available on most newer laptops, aimed directly at the eyeballs in question) can be used to completely defeat this system if used in conjunction with any other camera in the room, or any screen-scrape capable trojan.

If, instead, we used a challenge-response system where knowing a particular set of private values enabled for an answer that could be independently verified, the transaction could be sent "in the open" on malicious public networks with relative security.

Like ssh does when set up with RSA keys. Like your SSL-enabled browser does with any SSL certified site.

I do something similar with my bike locks - I engrave the combinations to the locks directly on the locks, after hashing them up a bit with a privately known, but simple, math function. I never have to worry about forgetting the combos to the locks, but I also don't have to worry anybody reading the combo - without knowing my (relatively simple) math function, the numbers on the locks are worthless.

No, I don't expect the average user to deal with a 128-bit key. But most passwords don't even keep pace with an 8-bit key in terms of security.

Level 9 - Snowball

[Anonymous Coward]

almost same as in Snowball text adventure from Level 9

look at terminal
[option1] [option2] [option3]
look at option1
blink
[another opt. ...

Video: Already done more than two years ago!

[DarkArathorn]

http://www.youtube.com/watch?v=cUt5o1MJZ20

The same thing it's at least two years old (presented in Chicago RSNA in 2005!), and patent pending.

BTW, this company it's a world leader in EyeTracking multimodal CONCRETE application! http://www.srlabs.it/

Nice sample size

[Anonymous Coward]

From the paper:

To evaluate EyePassword, we conducted user studies with 18 subjects, 9 males and 9 females with an average age of 21.

Read: A bunch of Stanford undergraduates and grad students (who probably know one of the authors) are on the custom designed and tested prototype with the tool's author in the room in case something goes wrong.

And 80 percent of them say "Yes your tool is new cool and super." Not very surprising.

Not hopeful

[vix86]

I'm not expecting to see this any time soon. The paper claims that password entry was on par with keyboard entry and this might be true, but the article doesn't really mention some of the other annoying aspects that go with eye tracking; like calibration. Having worked with eye tracking equipment, this is one of the most frustrating aspects to using it in research or just in general.

Each person's eye 'takes' a little bit differently to the camera and the IR. Slight head movements, changes in pupil dilation, obstructions (make-up), awkward reflections, and so on; can mess up the calibration and cause the system to think your eye is somewhere else. Compound flaky calibrations on top of unconscious erratic eye movements; it'd be amazing to get a system that would accurately read your input even half the time. It would very likely take a number of tries before you even got your password in correctly.

smile, you're recorded

[tilminator]

If the computer can accurately track my head and eyes when I'm entering passwords, I can do so all the time. Just imagine the privacy issues. Does your boss know if you are distracted or working (frequent eye shifts)? How about recognizing people by their eye movements - biometric identity theft? On the upside, you could use it to reliably research face mimics. Think about how much more $PRODUCT you could sell if you knew exactly which part of the commercial sucks.

The Assumption of Normal Vision

[Dunx]

I'm wondering if I would be able to use this at all since I have a squint.

The summary on Ars mentions that the system tracks the relative positions of the pupils so it might work, but if it is calibrated to non-squinty binocular vision then I suspect it wouldn't work for folks like me.

3 Login failures..

[Anonymous Coward]

"Use remaining good eye to login."

Recording what you're looking at

[Anonymous Coward]

A few months ago, /. ran an article about recording what you're looking at by the reflection on your eye. It sounds like that would be an effective way to combat "eye passwords" - and is probably how they're implemented, in the first place.

Neck pain

[saskboy]

You can get neck pain from subconsciously not moving your head much for a long time.

Wink and a Nod

[Doc Ruby]

/rolls eyes

What if I

[iLoveYoyo]

want to input an upper case letter or a special character like * or &? How many eyes do I have to have to complete these tasks...

Nothing to do with security

[umonkey]

The researchers also note that there are a number of potential applications for EyePassword's approach to visual input that have nothing to do with security.

They don't say how long will it take for the software to be installed free of charge and without the user's acknowledgement. To steal passwords at worst and to be used by advertisers at best. A necessary evil. But there are innocent applications, indeed, like integration with Flash and other interactive stuff, and this is also interesting, despite everything. I'd even say it's a great way to popularize the technology to use it later with the malicious intent.

More money, less security

[ricksmith]

This is obviuosly a marketing ploy by a company that can track eye movements, and they're looking for a killer app. This isn't it.

Shoulder surfing is just one of, oh, maybe a dozen ways to hack a password. It's not even the most common.

If you're going to buy expensive devices for authentication, there are lots of products that actually improve security: SecurID, SafeWord, those guys. Or buy a USB token with embedded challenge-response based on a public/private key pair.

Passwords and biometrics are both too easy to spoof and replay on networks.

Rick.

Finally...

[thetartanavenger]

Finally... An alternative to one handed typing...

A modest proposal

[StikyPad]

$50 says the first password you thought of was Up, Up, Down, Down, Left, Right, Left, Right, Select (Left wink), Start (Right wink).

$100 says you're trying to do that right now.