Slashdot Mirror
Identify and Verify Users Based on How They Type
LinucksGirl writes to share an IBM DeveloperWorks article that shows how to support user verification through keystroke-dynamics processing by modifying the GNOME Display Manager (GDM). You can create and store a one-way encrypted hash of your keystroke patterns when entering your user name. The article shows how to add code to GDM to read current keystroke patterns and permit a user to log in when the characteristics are a match. An interesting idea to be sure but I know I certainly am not that consistent when I type, so I'm skeptical of how well this may work.
...And now I can't log in.
Pass.
Spelling mistakes, grammatical errors, and stupid comments are intentional.
plus for me, this will only work if they test it against another login with the same username and password. The rhythm and speed of my typing in a username depends on which one it is, and the same goes for the password.
However, within the bounds of an identical username/password combination, I would imagine that it would work well for me. The problem is that if there are extenuating circumstances, this would lock me or someone else out of the computer. For instance, what if my wife needed to log in for me while I'm on a business trip? Or I die? Or I break my arm and have to type with one hand? I imagine the usefulness of this technology is in merely logging the "signature" pattern rather than locking someone else based on it. Bruce Schneier has the basic arguments and a much better analysis than I could produce.
There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
On the upside, no more embarrassing drunken e-mails to come back and bite you!
[Fuck Beta]
o0t!
Older then that...
I thought about it when I was a kid running my own BBS. The old BBS Software had a realtime display of what the person is typeing so I could normally tell if it is someone who is the origional user or someone using someones else account. I though about making a program that checks the time between keystrokes and give them a level of error, as extra security... but I decided not to do it, for the main reasons. Somone may have something in their hands that day or. Bit tired or Hyper, also a lot of pople had the passwords as Key Macros, so it was just kinda not worth the work and any fustration on the users part.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I wouldn't be surprised if it produced less false negatives than standard login/password pair. By false negatives I mean typos in username/password.
I mean, I don't know about you but I make typing mistakes at my login and password about as often as not, though I type them always in a consistent rhythm. The system could very neatly ignore the typos resulting from pressing a neighbor key or even typing with your hand a whole line of keys away, meaning you got half of what you typed wrong. "Timing is right, he pressed 'o' instead of 'p', we can accept it."
It should not replace password-based authentication but it can neatly suplement it - you either type your password 100% correctly (say, with one hand, holding earphone in the other so the "rhythm" is none), or you type it fast, you make a mistake, but the way you type it, and the kind of mistake says it's you and the password gets accepted.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
You get that with a well-formed password too. I can't type mine drunk, ever.
BTW, there's really nothing more easy/secure than a password. You even get to choose which end of a spectrum you want.
I never cease to be amazed at the lenghts people go to make something better...
The big question is, would you trust a GNOME developer to distinguish you from your sister if you can't be bothered to make up a password she can't guess? Nevermind more serious issues.
I don't think a username is enough of a sample set to determine a typing pattern. Wouldn't you need to copy down a paragraph of text to have any chance of determining patterns in typing style? I.e. at the very least, "the quick brown fox jumped over the lazy sleeping dog" type stuff to hit all the characters?
stuff |
There are characteristics in common with everything "normal" you type - for example, Mavis Beacon Teaches Typing(tm) back in the Glory Days of Windows 3.11 could tell me that my 4th finger on my left hand is weak - making a lot of typos on the "w", you see. It was nifty looking at the profiles of every user in that program for little tidbits like that, and logging onto my brother's profile and laughing as it commented how much he had "improved."
But... do those things apply when typing a password? The whole consistent rhythm and speed thing? Or maybe that makes it easier.
Perhaps a better solution would be to emulate voice recognition - train the security software to recognize your typing, and have it watch you as you're logged in. Just as you can train voice recognition to work with multiple speakers, you could train the security software to recognize "sober me", "drunk me", "caffeinated me", etc. (And not let "drunk me" send e-mail, and maybe schedule my development IDE processes at a higher priority for "caffeinated me", etc.)
DATABASE WOW WOW