Slashdot Mirror
Identify and Verify Users Based on How They Type
LinucksGirl writes to share an IBM DeveloperWorks article that shows how to support user verification through keystroke-dynamics processing by modifying the GNOME Display Manager (GDM). You can create and store a one-way encrypted hash of your keystroke patterns when entering your user name. The article shows how to add code to GDM to read current keystroke patterns and permit a user to log in when the characteristics are a match. An interesting idea to be sure but I know I certainly am not that consistent when I type, so I'm skeptical of how well this may work.
Well, it might work if they allow for a rather broad variation in the frequence of mistakes. But personally, I make much more typos depending on how tired I am and how much caffeine I've had lately. I would assume that others do too. So when I am well-rested I might appear to be a completely different person from when I am even slightly tired.
Any guest worker system is indistinguishable from indentured servitude.
An interesting idea to be sure but I know I certainly am not that consistent when I type, so I'm skeptical of how well this may work.
Something like a password that you've typed hundreds of times probably has a more regular pattern than you think, unless you regularly get interrupted in the half second i takes for you to type it... Muscle memory, etc
...And now I can't log in.
Pass.
Spelling mistakes, grammatical errors, and stupid comments are intentional.
How am I supposed to log in after a few too many? Wait, maybe thats not an issue after all, maybe its a feature.
Prediction: The real iPhone killer is going to be sex robots from Japan. Think about it.
My guess is that your inconsistency is part of what distinguishes you from other typists and the software uses that information to its advantage. Other people are more consistent, less consistent, inconsistent in different ways. I know I type with about four fingers: my left index finger, my right index and middle fingers, and my right thumb, and I also know I tend to make certain typos more often than others. I suspect that those things contribute to the distinct pattern in my typing that could be identified. Still, I'm sure I would not want to use to such a scheme for identity verification.
...the future crusty old bastards are already drinking the Kool-Aid.
While they're at it, they should have the software periodically verify that whoever is typing on the system is (or could be) the same person that is logged in.
But then again, how would I prank people at work when they leave their systems unlocked?
An interesting idea to be sure but I know I certainly am not that consistent when I type, so I'm skeptical of how well this may work.
That's precisely what some statistical methods are designed to do, find patterns about the inconsistencies. I haven't read this proposal, so can't comment more, but 'leaning' in the presence of variation is basically what modern statistics is all about.
Maybe not w/ gnome, but I remember a Slashdot article about this a few years back. One thing to note, while some people might be irregular, almost anyone who keys in a UID every day will have some sort of "pattern" to the time between keystrokes.
Typematic rate lol....
It's really interesting to see what the differences are between key presses when recording a macro w/ a G15. (if you have this awesome keyboard, and don't know what I am talking about try it out!) I have done this cause I am weird... but you could try too!
If you record a significant count of you typing in a UID and PW on a given site (that you use frequently) you will find a unique structure to the timing of the keystrokes. While the G15 doesn't go to the # of digits needed for secure authorization, it can show you that there is little variance over a large number of true trials.
How much is your data worth? Back it up now.
I don't know HOW to type!!
I got a catholic block.
I stopped reading at LinucksGirl. Be still my heart!
Dang, I still find it hard to press the C-T-R-L-A-L-T-D-E-L keys hard to press at the same time before entering my password on windows.
What happens if we don't even type on the same keyboard layout all the time? I'd love to see what that software would do!
http://www.springerlink.com/content/tcwlla3ptdd5u2ae/
How much is your data worth? Back it up now.
If you set it to verify loosely enough that it'll ignore subtle variations it could work, but think of the applications to preventing embarrassment... no more drunk IMs or emails that you really shouldn't send since it won't even let you log in.
Why not add a signature verification pad to the pc as well? If you can type the right way and reasonably falsify a signature you can login and go to /. to read all about it....
Support NYCountryLawyer RIAA vs People
http://www.biopassword.com/
It wouldn't be good as a primary means of validation (for the reasons listed in prior comments), but it would be good as a supplemental validation, giving a "higher likelihood" that the person is who they say they are.
What would this program think if it detected you periodically typing with just one hand?
Obama likes poor people so much, he wants to make more of them.
Having smelly feet all over their desktop is punishment enough...
Obama likes poor people so much, he wants to make more of them.
How on God's green earth am I going to write down my keystroke patterns on a sticky note on my monitor???
Freedom isn't free; its price is the well-being of others.
Please, drunk dialing should be a civil infraction penalized in this manner
for each # called...
1st offense:
A stern warning.
2nd offense:
$250 restitution to the victim, 1 months probation
3rd offense:
Death.
How much is your data worth? Back it up now.
.. but yeah.. there are so many issues.. What about signing in via a mobile device or a keyboard you're not used to? What about copy/pasting your password? (I do that sometimes..) It's a neat idea but it will fail.
"An interesting idea to be sure but I know I certainly am not that consistent when I type, so I'm skeptical of how well this may work."
I think this could be along the lines of identifying someone's signature, granted there is more detail in handwriting. However, we all have a very specific expectation of how the keys are going to type, we have our rhythm of how we're going to type it in time with the way we mentally chunk out login information. I would think that any habitual computer user can type their username/password in their sleep exactly the same as they would at a terminal, and all of that timing information should vary from person-to-person. Don't forget about pressure and keypress duration (quick taps versus "deeper" presses on keys).
Ahh you made me remember sweet violet, and BRE, and the Tacoma Area BBS listing (TABBS) that was printed in the paper. I met and ran into a few sysops in my day but never had the resources at that time to start one up. I often think the BBS format may rise again over tcp/ip if P2P gets destroyed. It'd be so easy to hide them on open networks accross the country.
But that is offtopic, and I am probably flagged as a terrorist after that last sentance...
Oh well.
How much is your data worth? Back it up now.
What if you happened to have fractured your wrist like I did recently? My typing is much different with my left hand in a short-arm cast now I can say for sure.
There are all sorts of hand injuries that could change your typing style.
Also is it just me or do people make more typos in the morning?
A quick skim, and I didn't see any details on the false alarm rate of this method, or any detail on how a user could log in with a broken (or severely papercut!) finger. Or when breaking in a new keyoard. It would certainly be a fatal problem for this method if it would lock out users who for whatever reason have their timings temporarily altered. It would also be a pretty fatal flaw if it turns out there's a substantial false alarm rate.
This works great until you lose a finger, thumb, hand, etc in that freak accident. Talk about adding insult to injury -- your own computer won't even accept you with your newfound handicap!
Christmas is the opposite of theft. See?
I don't fancy using this as a replacement for login/password, but if you haul Joe User down to HR for surfing pr0n, he pulls the "Naughty Bob stole my password" trick, and you can demonstrate that the usage pattern looks a hell of a lot more like Joe User's other sessions than Naughty Bob's... ...or vice versa, and have some idea who really did steal Joe's password.
Actually, such technology exists. Here's C|Net's shorter-nicer writeup. LG doesn't have any info on their US pages yet, but it's coming.
Misery loves company. Online misery loves unsuspecting random strangers.
My bank does this with my login info. You can know my username and password, but if you don't type it like I do, you don't get in.
This dates back to the days of Telegraph when individual telegraph operators could be identified by the way they type. They used to use it as a means of identification during WWII to see if they could find impostors. This book talks about it a little bit. I highly recommend it even otherwise - it's a very good read.
Also check out Keystroke Dynamics on Wikipedia.
I just have to believe this is going to produce a lot of rejected authorizations that shouldn't have been rejected. Also as someone pointed out, what about the legitimate times when someone else is using your username/password? (your boss needs something while you're away on vacation, etc).
This might work out well for some kind of intrusion detection system though. Look for cases where there's two people consistently typing in the password two different ways. Then set off an alert to the administrator. There's legit cases for that of course (root/admin password comes to mind), but you just exclude those cases.
AccountKiller
This does not seem like a bright idea at all. I was eating lucnh at my desk (yeah i know i know.. ) and i logged into /. by typing with one hand which is not how i usually type ..... there is just too many scenarios that go against this approach
I don't think a username is enough of a sample set to determine a typing pattern. Wouldn't you need to copy down a paragraph of text to have any chance of determining patterns in typing style? I.e. at the very least, "the quick brown fox jumped over the lazy sleeping dog" type stuff to hit all the characters?
stuff |
From bash.org
HOW THE FUCK CAN YOU TELL THAT I'M 13 BY LOOKING AT WHAT I'M WRITEING??????????????????????
stupid lameness filterstupid lameness filterstupid lameness filterstupid lameness filter stupid lameness filter Filter error: Please use fewer 'junk' characters. Filter error: Please use fewer 'junk' characters.
Ubuntu is an African word meaning 'I can't configure Debian'
Can any of the more experienced developers comment on this approach from a application desing point of view. the whole idea of a username/password is a combination of information that is unique. everybody on /. may have the same password but cannot have the same surname/password combo
The sample size we are talking about here (speed of typing)seems very small there has to be X number of users that type with the same speed unless there is another factor involved that is used in combination ?
Great. Now I'll need a second login for typing left handed when my wife is gone.
My bank uses this as the biometric factor required to access online services. When they announced this change I expected to be having to respond to my additional ID challenges almost every time I logged in. That hasn't turned out to be the case, I have only tripped up on it once. I suspect that it is not a strong enough test in itself to rely upon, but when combined with having to know the password it probably does add an extra layer of security.
Or one of the other virtual TTYs.
As for security, this would be nothing more than a silly, ineffective gimmick.
uh yeah, so there is software out there, that logs how you type your password, to be used as a method of user identification.
Oh, I dunno, how about your.. PASSWORD
This must have come from the Department of Redundancy Department.
Hi, I Boris. Hear fix bear, yes?
Whenever I select a new password for myself I am always a little bit slower at typing it because I am not used to it. Weeks go by and I find myself getting faster and faster at typing my password until finally I am able to type out a 20 character password in under a second.
To this system I will be two completely different people from the time I changed my password to the time I mastered it and presumably at notable milestones in between.
Obviously this is a problem.
from the all knowing wikipedia:
A Human Right
I typed a LOT different when I broke my finger and had the hand in a brace. B-(
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
I'm typing this lying in bed. My typing dynamics are completely different than when I'm sitting at a desk. The keyboard makes a difference too.
Engineering is the art of compromise.
At my office we have Outlook Web Access. It has a keystroke sensing thing. It's awful! I have a laptop that's connected to an ergonomic keyboard at work. When I'm on the road I use the built-in keyboard. I'm not sure which one I used to "register", but I can't get in now using either.
...and when this hashing algorithm was implemented in Javascript, it meant the end for anonymous cowards...
Since presumably this would also be a kind of keyboard sobriety test.
I'm responsible for maintenance and development of the online banking software for a mid-sized credit union. I'm currently in the midst of a project to integrate BioPassword's implementation of this technology as a second authentication factor in our online banking product, and while I initially had some skepticism of their claims, I can assure you that the technique is actually surprisingly effective, even for relatively inconsistent typists like myself.
Don't just take my word for it, though — BioPassword has an online demo that offers a good explanation of the technology, and a chance to try it out yourself: http://stage1.biopassword.com/democlient/
SIERRA TANGO FOXTROT UNIFORM
The concept appears in "When Harlie Was One" by David Gerrold (1972). The main (human) character sits down at a random typewriter, and on a whim types "Harlie". The typewriter immediately responds "Yes, Auberson?" Harlie, an intelligent machine, had infiltrated all of the network devices, and had recognized Auberson by the rhythm of his keystrokes.
This would be actually quite useful for monitoring unauthorized use. Username / password can be easily stolen (yellow stickers...) but the system should quietly inform IT stuff/security for possible misuse. After that it would be trivial to send in the lobby guard to nicely say hi to Liz the secretary and see if she has a broken her arm or is it someone else using her workstation.
I'll settle for getting GDM to distinguish between a my typing and my cat's.
I write sci-fi for metalheads
Whatabout askingtheuser howmany cupsofcoffee they'vehad aspartof thelogin process,cuz I knowmytyping getsmuch betterafter2pots. Iloveallofyou.
/shoutout totheguy whoposted likethisrecently.
It should be used for primary validation because it is hardened against keylogging. The trick to this is that you don't have to type in the same phrase every time, in fact repeating the same phrase should be disallowed.
Password login should be secondary and have it be algorithmic or challenge/response based.
They ARE out to get you simply because They are in it for themselves and they don't care about you.
I remember someone figured this out 10 or 15 years ago. It does work, and surprisingly well. But it isn't exactly news. Though it is cute that GDM can support it.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
I agree it's probably not going to work as full-blown analysis, especially as typing patterns change...
But I did have a very simple variant of this: I imposed a timeout. I had a 20-character (roughly) password that I could type in about two seconds, so I set the screensaver password timeout to five seconds. That, and it was in dvorak. So someone had to know my password and be able to type dvorak as fast as I can to login, but there was little chance that a change in typing patterns would lock me out, unless my typing speed suddenly slowed for some reason.
Don't thank God, thank a doctor!
If they added audible cues eg. music tones corresponding to the stroke frequencies that would be a pretty good way to get feedback to help avoid mistakes. They could also provide a text reproduction of those tones if you needed to tell someone your password.
Just a thought.
:T:R:A:N:S:
There was a 1960s sci fi book, Colossus, about a computer that joined with its Soviet counterpart in taking over the world. The book was made into a movie The Forbin Project. In the book, the computer knew who was logging in by measuring the keystroke timing of the person typing. Life imitates obscure art.
The login / password input is done through a Flash object. If the rhythm is correct, you're logged in just like you used to be with the old system. If the rhythm is not correct, you're presented with some additional security questions before being allowed to proceed.
There was something like this in the novel "Miss Wyoming" by Douglas Coupland.
At a glance the patent "Method and apparatus for identifying unique client users from user behavioral data" seems to apply: http://www.patentstorm.us/patents/7092926-description.html
Sho wheen I'm tis dwunk, I'm totawlly screweded. Fickig asweome! Signe me up!
Wouldn't this be much better for picking up if somebody else is using the computer, e.g tell if another person is using my laptop and hide the porn stash.
Id leave username/pass for login but, if your computer doesnt think its you it could lock the keychain preventing access to anything that youve chosen to lock down.
IranAir Flight 655 never forget!
This would be great if it could sense when people are drunk; kind of like a breathalizer, but triggered by lack of muscle control.
Another practical use would be if there were pressure-sensitive keyboards and it could tell when you're pissed off by analyzing how hard you press down on the keys. That might actually postpone a few people's employment termination dates.
This is a very old concept, and it's a dumb one.
People do not type very consistently.
If you are old/injured you're screwed.
If you need to access an account for someone you can't.
If you get a new keyboard, you're screwed.
If someone listens in while you type, you're screwed. (Rhythms are very easy to remember).
What - will people turn their backs AND cover their ears while you log in now?
I know there was research to predict typing based on sounds (saying each key makes a different sound when pressed), but really, that's totally unreliable and hinges on dictionary matching anyway.
The data is not a very useful thing to track, either.
Anyone on the inside could just alter their typing a bit and later say "See? My account was hacked. That's not my typing pattern!"
Wait a minute! You mean they're actually adding a feature to GNOME? The developer responsible for that is so fired!
Saw this at some German university years ago, forgot the name, they wrote a custom GINA and implemented it for some flavor of Windows.
I don't think they thought it was reliable or secure enough in the end. Was an interesting bit of research and code though.
I don't want this information stored.
"to read current keystroke patterns and permit a user to log in when the characteristics are a match."
You mean, like a password?
You can tell that a few people have never had the joy of meeting a non-English keyboard. For example, the person who made ~~~~ the markup for signing a Wikia edit clearly doesn't have to type Alt-Gr-4 Space to type a single tilde. And I struggled for ages with placing a mark in nano, because Ctrl-^ is a bit hard to type when ^ is Shift-` Space. I only just found out that Alt-A is an alternative.
My username is a single character....where the fsck is the pattern in that?
Like a bad flu, this comes up every few years. It still isn't a good idea for oh-so-many reasons.
Another thing that this does, obviously, is nerf all hackers and automated programs.
In my case, I'd go one step further and enter my password with a one second pause between characters. Anything automated or even if it has built-in random delays is instant failure.
What about those of us with horribly short usernames? I'm "tom" on my personal box, so I can't imagine two samples (time between T and O, and between O and M) is enough to tell if it's me or not. Plus, like many posters said, that doesn't work if I'm logging in one-handed. (But that could be recorded as a separate pattern, as I always do it the same way.)
ttuttle is a rankmaniac
I wonder how much your typing differs from keyboard to keyboard. I'd love to figure out which differences are due solely to the muscles and remain static whatever you use to input and which are variable based on using the laptop keyboard/desktop keyboard or the work computer/home computer.
I used to work for Zenith back in '96 and we tried to recognize logins by the way people typed. It successfully recognized when I logged in with just my left, right or both hands. There was a problem though. Good typists type fast. Because of that, good typist filled the keyboard buffer and the software saw them all good typists as typing at the same speed. Looks like keyboard buffers are faster now. We were using a lightning fast 16MHz 386 at the time. Ah, the memories of starting a compile overnight and it not being finished when you come in the next morning.
--
Some times I sit and think and sometimes I just sit.
GPG keys rather than passwords, finger/penis print, etc.
Why the fuck not? Encrypted logins for everyone!
My online banking account has used keystroke rhythm for about 8 months as the second factor (besides user-chosen account name and password which meets minimum standards [length, variation, etc.]) for login authentication.
I saw this in practice in 1997. I don't know how old it was at the time.
So my brothers bank is using this already. He needed me (don't ask why) to login to his acct the other day. He gave me his username/password and the damn system wouldn't let me in as my cadence/speed of entry was wrong. This should be a second level of authentication, not the primary. I had the right u/p.
Given it was an Apple II, there were plenty of other ways in, unless you had padlocks on the floppy drives and you replaced the ROMS.
In other words this isn't a new idea. It's been around for at least 25 years.
Support SETI@home
The concept is even older than that. I did something like this on my 8088 about
18 years ago, and since I was a kid, I think that many other people might have
done this earlier.
It was pretty simple under DOS because you could easily read one char at a time and
check the elapsed time between each.
It worked very well for words that I was used to type a lot (eg: password). You
don't imagine how accurate you are when you type common words. Far more reliable
than voice recognition IMHO.
However, one poster reported a risk of not being able to log in after a broken
finger. Maybe a complex passphrase should be used as an alternative for such
situations.
Willy
This would have sucked when I switched from Qwerty to Dvorak last August.
Do you really give your passwords out? I guess I have never been in a mission critical place, but??? I won't give my password out, EVER! OK, I lied, I used to. Having been burned in the past though, makes me not interested in doing it anymore. If you needed it that bad you should have told me when I was around, and if it is work related, ask the admin to access it.
Memory is deceptive because it is colored by today's events. - Albert Einstein
Maybe each company would ban non-standard keyboards. I mean your typing rhythm is definitely off if you're using a keyboard that is very different from what you're used to. (ergonomic split keyboards vs standard)
A. How much sleep you've not had, and/or
B. Which drug(s) you're on.
RR
Do you really give your passwords out?
Generally no, but if there were a good reason to do so, of course. I've also seen over the years it's very common for people to give passwords to trusted colleagues. It's how they get work done, and nobody really thinks much of it.
AccountKiller
...positively ancient.
I actually programmed something like this on my Olivetti M24 (8086 CPU, 256K RAM, top of the line for the time) in the late 80s (yes, I'm an Old Fart).
No, no, I'm no genius - I got the code from the grand magazine "Creative Computing". I believe the program (in BASIC, natch) can also be found in their wonderful "101 Basic Computer Games I/II" books.
Free PC version of ChipWits at http://www.breueronline.de/klaus/chipwits/