Slashdot Mirror

← Back to Stories (view on slashdot.org)

Passthoughts, Not Passwords: Authentication Via Brainwaves

Posted by samzenpus on from the get-your-thinking-straight dept.

CowboyRobot writes "A new study by researchers from the U.C. Berkeley School of Information examined the brainwave signals of individuals performing specific actions to see if they can be consistently matched to the right individual. To measure the subjects' brainwaves, the team utilized the NeuroSky Mindset, a Bluetooth headset that records Electroencephalographic (EEG) activity. In the end, the team was able to match the brainwave signals with 99% accuracy (pdf). 'We are not trying to trace back from a brainwave signal to a specific person,' explains Prof. John Chuang, who led the team. 'That would be a much more difficult problem. Rather, our task is to determine if a presented brainwave signal matches the brainwave signals previously submitted by the user when they were setting up their pass-thought.'"

104 comments

  1. Walk by lockouts by jbmartin6 · · Score: 5, Funny

    Great, now anyone walking by can lock out my account with failed auth attempts

    --
    This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    1. Re:Walk by lockouts by ByOhTek · · Score: 4, Funny

      I'm more worried about them realizing I'm not human, from my brain waves. I don't want to go back to my homeworld! Also, how much testing did they do to ensure there aren't issues with emotional state or distraction? If I had a family even and was stuck listening to Beyonce or Katy Perry thanks to my sister's atrocious taste in "music"... Is having that crap stuck in my head going to prevent a login?

      --
      Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
    2. Re:Walk by lockouts by Chrisq · · Score: 1

      I'm more worried about them realizing I'm not human, from my brain waves. I don't want to go back to my homeworld!

      Ask the captain for the brainwave spoofing kit

    3. Re:Walk by lockouts by ByOhTek · · Score: 1

      Captain? What captain! Shit, I need to hide!

      --
      Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
    4. Re:Walk by lockouts by Anonymous Coward · · Score: 1

      On the plus side, this method prevents drunk dialing/texting with no additional work - unlocking your phone with all them boozy thoughts will be impossible.

    5. Re:Walk by lockouts by skids · · Score: 1

      The big plus side of this is that when Hans Gruber wants to get access to your system, he has to keep you alive, rather than cut off your hand and/or eyeball.

      --
      Someone had to do it.
    6. Re:Walk by lockouts by Dunbal · · Score: 1

      Unless your pass-thought was created while you were drunk, too. In which case the challenge will be exactly how many drinks did you have. Failed attempt - have another drink!

      --
      Seven puppies were harmed during the making of this post.
    7. Re:Walk by lockouts by Yakasha · · Score: 1

      I'm more worried about them realizing I'm not human, from my brain waves.

      Not your fault you were born a nigger. You still suck ass, but that's not your fault. Now go be a gangsta or get some welfare or abandon your kids to a single mother with a shitty attitude.

      I don't want to go back to my homeworld!

      Yes it is actually called the Third World. It is the very best blacks could do without being governed by whites. History proves it, just look at Haiti. Didn't go to shit until after control was handed to the darkies. Ah well. No welfare for you if you go there.

      w
      t
      f

      Gary Busey?

    8. Re:Walk by lockouts by Anonymous Coward · · Score: 0

      Multi-factor authentication is better, IMO, than fancy other kinds of passwords. This also makes the crackability of a password less important.

    9. Re:Walk by lockouts by KingBenny · · Score: 1

      ah, you've finally arrived, it was getting lonely here among the natives
      isn't this something like sending data over a wi-fi without passing it through an encrypted 'tunnel' so anyone in the vicinity with a homemade model built on schematics from when it was hacked about one day after release could just record the signal and gain instant access just as well?

      --
      Free speech was meant to be free for all... how can anyone grow up in a nanny state ?
  2. Never Work by Greyfox · · Score: 3, Funny

    I'm afraid that wouldn't work for several of my past managers. Heey-oh!

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

  3. I don't need to know what you're thinking... by dclozier · · Score: 2

    I'll tell you what to think!
    http://xkcd.com/538/ ;)

  4. thoughtcrime is comeing by Anonymous Coward · · Score: 1

    thoughtcrime is comeing

    1. Re: thoughtcrime is comeing by Anonymous Coward · · Score: 2, Insightful

      comeing

      But spelling crimes are already here.

    2. Re: thoughtcrime is comeing by Errol+backfiring · · Score: 1

      You unbellythinkful clod!

      --
      Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
    3. Re: thoughtcrime is comeing by Yakasha · · Score: 1

      comeing

      But spelling crimes are already here.

      jerk

  5. Talk about forgetting your password! by __aaltlg1547 · · Score: 5, Insightful

    "I thought my passthought. But maybe I didn't think it the right way. Let me try again..."

    Just what we need, an even more complicated and harder to use apparatus with a reduced probability of correctly identifying the right user.

    Since when is "works correctly 99% of the time" good enough for an authentication system?

    1. Re:Talk about forgetting your password! by ByOhTek · · Score: 3, Interesting

      Since when is "works correctly 99% of the time" good enough for an authentication system?

      And how often do you mistype your password? I doubt many get their password right even 90% of the time unless they have rather bad passwords.

      Also, there's false positive vs. false negative. False negatives aren't so bad (especially at 1%, when retries are possible). False positives are what are really of concern.

      --
      Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
    2. Re:Talk about forgetting your password! by jouassou · · Score: 4, Interesting

      Since when is "works correctly 99% of the time" good enough for an authentication system?

      It isn't. But it is an interesting proof-of-concept, which shows that using passthoughts as identification is actually possible.

      One interesting thought would be to combine passthoughts with other authentication technologies. Imagine walking up to a door that first performs face recognition and retina scans to determine who you appear to be. The system then accesses a database of passphrases associated with your user, displays a random one on a screen, and asks you to read it out loud. The system then uses a combination of voice recognition and brainwave scans to check if you're really who you appear to be.

      Although all these technologies currently have suboptimal success rates, they might yield good security if you combine them.

    3. Re:Talk about forgetting your password! by David_Hart · · Score: 4, Insightful

      "I thought my passthought. But maybe I didn't think it the right way. Let me try again..."

      Just what we need, an even more complicated and harder to use apparatus with a reduced probability of correctly identifying the right user.

      Since when is "works correctly 99% of the time" good enough for an authentication system?

      And what happens to the success rate if your brain chemistry and/or thought patterns change?

      We know that changes take place in the brain during puberty, pregnancy, when in love, stress, medical conditions, etc. I'm curious if their testing included these scenarios. Granted, it would prevent drive-by tweeting if people would have to calm down before they could login... (grin)

    4. Re:Talk about forgetting your password! by gnapster · · Score: 2

      Granted, it would prevent drive-by tweeting if people would have to calm down before they could login... (grin)

      I plan to set my passthought while browsing Reddit, so the only tweets I can send are drive-byes.

    5. Re:Talk about forgetting your password! by Kongming · · Score: 2

      I don't think that would be a concern, on account of the fact that they are probably relying mainly upon information that is not really "brain waves".

      The headset supposedly uses both EEG (brain waves) and EMG (electrical activity from muscle firing). However, measuring the electrical activity of neurons (very small and very weak) with any kind of specificity by using electrodes placed on the other side of the skull and other protective tissue is... let us just call it "nontrivial". EMG signals are much stronger.

      From the paper:

      "In particular, personalized mental tasks (e.g., sing their favorite song silently, focus on their personal pass-thought) do not produce higher signal similarity or authentication accuracy over mental tasks that are common to all subjects (e.g., close eyes and focus on breathing)."

      Similarly, this discussion includes a comment by someone who claims to have developed for the platform, "IMHO, the NeuroSky devices which are currently on the market exist mostly to record EMG from the forehead."

      The paper does not mention EMG. Perhaps they are are specifically avoiding making use of EMG information from the headset, although they do not mention any such technique in the paper. Personally, I would wager that unless you have significant changes to the musculature of your face and scalp or suffer new large-scale brain damage or other abnormalities, your "password" would not be terribly likely to change.

      --
      (no sig)
    6. Re:Talk about forgetting your password! by Immerman · · Score: 3, Insightful

      Indeed, though a 1% false-positive rate would still make for a really lousy attack vector for anyone with serious intent - you're unlikley to get past it for the first time when it matters, and unlike a password which stays compromised until changed which allows a leisurely preparatory attack, slipping through on a false positive probably won't reliably let you through a second time when it counts. Not something you'd want as the only layer of defense protecting your top secret documents, but a significant improvement over passwords. A huge advantage for most applications would be that it makes the security system immune to attack via social engineering, probably the single most successful attack vector in the world, as well as "security degredation by convenience" where people share around passwords for accounts with access to resources that are supposed to be restricted.

      Might also be very viable as part of a multi-factor authentication system, the pass-thought is already a two-factor system (thought + brain), adding a third factor with higher reliability would likely push the security beyond almost everything currently in use.

      --
      --- Most topics have many sides worth arguing, allow me to take one opposite you.
    7. Re:Talk about forgetting your password! by Anonymous Coward · · Score: 0

      OK,

      I'll say this once so try to keep up.

      Biometrics are only useful as a replacement for a user ID. Not for a password.

      Why you ask? Because you can't easily change them. This means that if it becomes posible to spoof the system (which is likely as to date every biometric system has been trivially spoofed), a compromised database means you're now unable to secure any other accounts, and unable to revoke access to the compromised account. It's the same thing that's wrong with using a SSN for a password.

      This is why passwords and physical keys work. They can be changed when they become compromised, and you (can) use a different one for every lock.

      The end result is that no matter how many layers of biometric screening you do, you still ultimately have to have a revokable key to fall back on for when your biometric profile gets leaked. Thus you still need to type in your damn password.

      Given that, there is very little value in layering biomentric systems.

    8. Re:Talk about forgetting your password! by Dunbal · · Score: 1

      I think the concept you are missing is that at one point, user ID and password will eventually be merged into one.

      --
      Seven puppies were harmed during the making of this post.
    9. Re:Talk about forgetting your password! by mjr167 · · Score: 2

      No, I think that is his point. And that it's a bad idea. If the user id is the password, you have the same problem you have with credit cards and SSNs. Acquiring a user's ID should not be enough to authenticate the user. The ID just identifies the user and can be used by people that need to refer to the user. You need something else to authenticate. Knowing my name shouldn't authenticate as me. Neither should having my fingers or my eyes.

      The idea to use the biometrics to identify the user and the pass-thought to authenticate might accomplish this, and you still separate ID and authentication.

    10. Re:Talk about forgetting your password! by __aaltlg1547 · · Score: 1

      "I thought my passthought. But maybe I didn't think it the right way. Let me try again..."

      Just what we need, an even more complicated and harder to use apparatus with a reduced probability of correctly identifying the right user.

      Since when is "works correctly 99% of the time" good enough for an authentication system?

      And what happens to the success rate if your brain chemistry and/or thought patterns change?

      We know that changes take place in the brain during puberty, pregnancy, when in love, stress, medical conditions, etc. I'm curious if their testing included these scenarios. Granted, it would prevent drive-by tweeting if people would have to calm down before they could login... (grin)

      Or when your frustration level continually elevates due to repeated authentication failures.

    11. Re:Talk about forgetting your password! by Anonymous Coward · · Score: 0

      First of all, it seems like the previous three comments are a bit unclear about the idea of Type I vs. Type II errors, how they are related and what they mean exactly. Here's good information that includes the proper terminology along with explanations of the concepts so you can speak about the subject clearly. Also, for this specific topic, there is a section near the bottom that talks about how this errors relate to biometrics (brain wave pattern matching fits this category exactly). The important number for this system is the type II errors, or the "false accept rate". This is the "FAR" mentioned throughout the article. This number should be zero or very very close for the system to be an acceptable method of authentication.

  6. first thought by Anonymous Coward · · Score: 0

    You must think in Russian...you cannot think in English and transpose...you must think in Russian.

    1. Re:first thought by Anonymous Coward · · Score: 0

      You're ancient. Thank you.

    2. Re:first thought by mrbester · · Score: 1

      That means I am as well *sob*

      --
      "Wait. Something's happening. It's opening up! My God, it's full of apricots!"
  7. Why this is idiotic by slashmydots · · Score: 1

    So first we had passwords. Then they invented fingerprint readers so now everyone can log in with either a fingerprint or a password as a backup in case the fingerprint reader doesn't work. Obviously 2 ways of getting into a system is MUCH more secure. Same here. I bet this will be backed by a password.

    1. Re:Why this is idiotic by Anonymous Coward · · Score: 0

      Did your post actually say anything?

      captcha:blabbing

    2. Re:Why this is idiotic by BlindMaster · · Score: 1

      Furthermore, it requires an "action" to be performed. I hope that action is convenience to do in public, plus doing it quick.

      However, I suppose this is the first step of "reading" data from the brain. By collecting enough data, we may actually understand individual (hint for Google). If we actually can understand living things by brainwave, it can replace password as a way to recognize people (I suppose this is how we "know" others by understanding their ways of doing things).

    3. Re:Why this is idiotic by gnapster · · Score: 1

      This reminds me of the film Minority Report; retinas at-a-distance are quick and convenient in public. One of the concerns about eyeballs and fingers is that if someone wants to impersonate me is to forcibly take them. (xkcd #538 with knives, not wrenches.) Am I safe with brainwaves? Does that de-escalate it from knife back down to wrench?

    4. Re:Why this is idiotic by Immerman · · Score: 1

      Even better - it's something that can't be taken (knife-proof) and also can't be given (resistant to rubber hoses, social engineering, and lax security practices). Since it depends on the way *your* brain manifests the thought, you personally have to be present in order to get past the system, which complicates many attack scenarios. And all in all I'd rather be kidnapped than have an eye/finger/etc stolen, if anything I suspect my chances of survival are moderately better, not to mention I come out of the ordeal in one piece.

      --
      --- Most topics have many sides worth arguing, allow me to take one opposite you.
    5. Re:Why this is idiotic by JaredOfEuropa · · Score: 2

      That depends. On the one hand, if you're kidnapped, your brain might react differently under duress and the system would reject your logon attempt (and hopefully the kidnappers know that!). On the other hand, somewhere in the authentication chain, your brain waves are converted into electronic signals and at that point they could be "skimmed" and replayed, so it doesn't replace 2 factor authentication.

      --
      If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
    6. Re:Why this is idiotic by Anonymous Coward · · Score: 0

      So this system is "idiotic" because of reasons that have nothing to do with the system itself and everything to do with implementation practices that apply equally to any other type of authentication mechanism?

      You really are a special kind of stupid.

    7. Re:Why this is idiotic by Anonymous Coward · · Score: 0

      More than yours... and in turn, mine...

    8. Re:Why this is idiotic by Immerman · · Score: 1

      >skimmed and replayed
      That completely depends on physical security of the input device. Trying to "replay" a brain pattern into something designed to read it directly from a brain will likely be at least as difficult as tricking any other biometric device, but certainly if you can bypass the scanner by using your own replay device it should be easy enough, which goes the same for any biometric scanner - a fake retinal scanner is no doubt likewise much easier to make than a fake eye.

      --
      --- Most topics have many sides worth arguing, allow me to take one opposite you.
    9. Re:Why this is idiotic by Anonymous Coward · · Score: 0

      Furthermore, it requires an "action" to be performed. I hope that action is convenience to do in public, plus doing it quick.

      I put on my Robe and Wizard Hat...

  8. Escalator to hell by Anonymous Coward · · Score: 0

    1. To by-pass fingerprint auth: chop off hand of victim
    2. To by-pass retina auth: pluck out eye
    3. To by-pass brainwave auth: chop off head

    As for item 3, wasn't this already written somewjhere in some american classic sci-fi, maybe Heinlein?

    1. Re:Escalator to hell by kaizendojo · · Score: 1

      It would be very difficult to hack a brainwave interface with a brain dead head.

    2. Re:Escalator to hell by Anonymous Coward · · Score: 0

      Not if it were a politician's account!

    3. Re:Escalator to hell by kaizendojo · · Score: 1

      Again, brain dead...

    4. Re:Escalator to hell by Anonymous Coward · · Score: 0

      Spoken like a true BOFH.

      Who cares that they chop off the heads of our users, as long as they aren't getting into the system.

      Because a computer is worth more than a human life.

    5. Re:Escalator to hell by Errol+backfiring · · Score: 3, Interesting

      But it might be quite easy with a live head. If you can intercept the signal, you can reproduce it. And intercepting a bluetooth signal should not be that hard. The problem is that it takes some "middle man hardware" to get the brainwaves into the computer. And middlemen can be a lot easier to fake. It is a bit like voice recognition: the voice may be personal and unique (or personal and unique enough), but recording a voice and playing it back is dead easy.

      --
      Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
    6. Re:Escalator to hell by andrewbaldwin · · Score: 1

      It would be very difficult to hack a brainwave interface with a brain dead head.

      perfect!
      ... keeps your system safe from managers :-)

    7. Re:Escalator to hell by radtea · · Score: 1

      It is a bit like voice recognition: the voice may be personal and unique (or personal and unique enough), but recording a voice and playing it back is dead easy.

      And yet people remain fascinated with these unchangable, non-repudiatable, easily spoofed means of biometric identification. I really don't get it.

      --
      Blasphemy is a human right. Blasphemophobia kills.
    8. Re:Escalator to hell by lister+king+of+smeg · · Score: 1

      well they could encrypt the data being transmitted by the wireless headset and have the key change over time to prevent record and playback attacks, or just hardwire it.

      --
      ---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
    9. Re:Escalator to hell by Maxwell'sSilverLART · · Score: 1

      Spoken like a true BOFH.

      Who cares that they chop off the heads of our users, as long as they aren't getting into the system.

      Because a computer is worth more than a human life.

      Objection! Assumes facts not in evidence!

      OP clearly said "users."

      --
      Moderate drunk! It's more fun that way!
  9. Thoughts and the associated brainwaves static? by Anonymous Coward · · Score: 0

    Or do they both change over time? For example, will the thought of the word anal be the same before and after having anal sex for the first time? I doubt it, my thoughts changed pretty dramatic.

    1. Re:Thoughts and the associated brainwaves static? by Anonymous Coward · · Score: 0

      Just hearing your cell-mate say, "Grab your ankles" would do it.

  10. Open Sesame? by Anonymous Coward · · Score: 1

    What If you make a happy thought of your girlfriend and then breakup with her? You can't form that joyful thought anymore, can you still unlock it afterwards?

    1. Re:Open Sesame? by Anonymous Coward · · Score: 0

      What If you make a happy thought of your girlfriend and then breakup with her? You can't form that joyful thought anymore, can you still unlock it afterwards?

      That's one of the fringe benefits of being an ex. You can think of "happy thoughts" with your ex at any time.

  11. Worse than having your account hacked by Anonymous Coward · · Score: 0

    Would be to be kidnapped and ordered at gunpoint to open your account so it could be hacked. That's an area of concern for these biometric schemes.

  12. Helpdesk Request #65398 by Rob+Riggs · · Score: 3, Insightful

    Helpdesk,

    I need help logging in. I have a migraine and can't get my passthought right. Can you send up two aspirin tablets.

    Thanks

    --
    the growth in cynicism and rebellion has not been without cause
  13. Think happy thoughts by mwvdlee · · Score: 3, Funny

    So now every time I want to gain access I have to think the same thing I thought when I first entered the passthought.
    "Okay, no thinking of naked girls now, anything but naked girls. Betty White! Yes, Betty White completely dressed, dressed in sexy lingerie... oh god, not that either, that's horri*".
    "thank you, passthough recorded".

    --
    Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
    1. Re:Think happy thoughts by russotto · · Score: 1

      The only way to block out bad Betty White images is with good Betty White images.

    2. Re:Think happy thoughts by Culture20 · · Score: 1

      Yes, but they can't figure out what you were thinking, only the pattern it creates for the brain scan. It's like a salted and hashed passphrase from the perspective of the brain scanner You could even tell someone else what to think, but the hashing algorithm (your physical brain) is an extra secret they can't replicate. ..for the time being.

    3. Re:Think happy thoughts by lister+king+of+smeg · · Score: 1

      Yes, but they can't figure out what you were thinking, only the pattern it creates for the brain scan. It's like a salted and hashed passphrase from the perspective of the brain scanner You could even tell someone else what to think, but the hashing algorithm (your physical brain) is an extra secret they can't replicate. ..for the time being.

      I would not be so sure about that, they are getting closer to being able to reconstruct an image from thought with fmri,
      http://www.popsci.com/science/article/2011-09/mind-reading-tech-reconstructs-videos-brain-images

      --
      ---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
  14. Not ready for prime time by Anonymous Coward · · Score: 0

    I don't want to carry another device to attach to my notebook, small computer, or iWatch. When they get it to work with out an accessory I'll consider it. It shouldn't be too hard; for many years my wife has been only too willing to tell my what current thoughts and feelings are.

  15. Use concept is authentication for financial use by girlinatrainingbra · · Score: 1
    It would appear that the use-case for this technology is as an authentication system for access to financial institutions or accounts since it was presented at a conference on Financial Cryptography and Data Security. TFA points out that The team's findings were presented at the 17th International Conference on Financial Cryptography and Data Security in Japan this week. In a paper, the team argues that the embedding of EEG sensors in wireless headsets and other consumer electronics makes authenticating users based on their brainwave signals a realistic possibility.

    The current headset is unwieldy. Would the banks make you put on a headset and think "i am the real me" when you get to the teller's station instead of signing on the electronic signature pad?

  16. As A Sysadmin... by Anonymous Coward · · Score: 0

    How the hell do they expect me to do password resets now?

    1. Re:As A Sysadmin... by MrMickS · · Score: 1

      How the hell do they expect me to do password resets now?

      I'm sure that Dremel will come out with an attachment for that.

      --
      You may think me a tired, old, cynic. I'd have to disagree about the tired bit.
    2. Re:As A Sysadmin... by Anonymous Coward · · Score: 0

      I think you could just 'taze' them...

    3. Re:As A Sysadmin... by Immerman · · Score: 1

      Same way you should be doing it now - require them to be physically present with proof of identity. Or do you reset passwords in response to any random email/phone request that sounds like it came from the authorized account holder?

      --
      --- Most topics have many sides worth arguing, allow me to take one opposite you.
  17. I'm thinking of a word. by PPH · · Score: 3, Funny

    Please try another thought password. "Tits" is not sufficiently secure.

    --
    Have gnu, will travel.
    1. Re:I'm thinking of a word. by Anonymous Coward · · Score: 0

      Parsus major
      **Passthought Accepted**

  18. replay attacks anyone? by Anonymous Coward · · Score: 0

    So how does this deal with replay type attacks, where you "record" the brainwaves and play them back?

    1. Re:replay attacks anyone? by Anonymous Coward · · Score: 0

      Probably with about the same level of protection as where you somehow "record" the keystrokes of a classical password and play them back.

    2. Re:replay attacks anyone? by Anonymous Coward · · Score: 0

      blue tooth is secure enough for my thoughts

  19. authentication in general see DARPA BAA by Anonymous Coward · · Score: 0

    DARPA is looking for biometric authentication methods that don't require the active participation of the user. For instance, if you had a smartphone that detected your unique smell, it could do that without you needing to tell it to authenticate, or to have a particular password, etc. And, you could authenticate continuously, rather than just when starting to use the device.
    these sorts of schemes are also much more difficult to fake with a replica, unlike things like fingerprint readers

    DARPA-BAA-13-16 Active Authentication

  20. Sounds like a great system by Anonymous Coward · · Score: 0

    Because brains certainly don't change over time.

    1. Re:Sounds like a great system by mark-t · · Score: 1

      Brains change over time, but such change is ordinarily slow enough that if you are keeping the database of what the person's current brain waves look like up to date, then such normal evolution would not be a problem.

      The only time it would be is on account of certain types of trauma, which can very abruptly and very quickly change a person's thought patterns.

      --
      File under 'M' for 'Manic ranting'
    2. Re:Sounds like a great system by Errol+backfiring · · Score: 1

      You sure? If this proves "secure", say for a doomsday device to be activated only by the president, it would require the president to have his brainwaves recorded periodically. And each recording is an opportunity to breach the system. And if the shit really hits the fan, he might be too upset to authenticate (which, in this particular case, would be a good thing).

      --
      Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
  21. Whovians by drachenfyre · · Score: 2

    So now everyone who watches Doctor Who will set their passwords to "Crimson, Eleven, Delight, Petrichor".

    At least it'll be easy to get into my wife's computer.....

    1. Re:Whovians by Immerman · · Score: 1

      Only if you can control her brain to think it with.

      --
      --- Most topics have many sides worth arguing, allow me to take one opposite you.
    2. Re:Whovians by lister+king+of+smeg · · Score: 1

      i was thinking that exact same thing.

      --
      ---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
  22. Dem Blinken Lights by Anonymous Coward · · Score: 0

    yay! It's not like they could be hacked by flickering lights, screens, etc. Or anything like that. Tarkovsky, you there?

  23. Sneakers rewrite? by mortonda · · Score: 1

    "My brain is my password. Verify me".

    OTOH... Since that can't be recorded on a tape, it gets kinda messy.

  24. Interesting by Anonymous Coward · · Score: 0

    It's an interesting study, but from a security point of view, If I wanted to get into somebody's system that used this type of authentication, then I would only need to get them to think about it while I am recording their brainwaves.

    Another security vulnerability question is, can we figure out anybody's password on any system, if we can record their brainwaves while they are thinking about it?

    1. Re:Interesting by mark-t · · Score: 1

      You can record their brainwaves, but how do you reproduce them to another device that records them?

      --
      File under 'M' for 'Manic ranting'
    2. Re:Interesting by Servercide · · Score: 1

      You don't reproduce them. You just record your interpretation of brainwave sequences. Then that interpretation can be passed on. Like the mp3 of the brainwave world. All you need is one way communication.

    3. Re:Interesting by mark-t · · Score: 1

      Uhm.... if you're not reproducing them, how would you get into somebody's system that used this type of authentication? Sure, you can record their brainwaves while they are thinking whatever it is they need to think, but how on earth would that recording actually help *you* get into their system, which only records brainwaves?

      --
      File under 'M' for 'Manic ranting'
    4. Re:Interesting by zlives · · Score: 1

      assuming there is some sort of wireless receiver from the phone with EEG sensors (hopefully not BT) that sends the brain signal over... record replay!!?

    5. Re:Interesting by Servercide · · Score: 1

      Well, to be useful in a computing environment you would have to convert the analog brainwaves into a digital format. Now, we can pretend that each and every manufacturer will have their own proprietary way of digitally converting these waves. Or, We can pretend that there will be an industry standardized format for converting analog brainwaves into a digital format (this is the more likely case IMO).

      So, your Brainwave Pattern + Industry Standard Conversion = Valid Authentication Token. What is keeping me from taking that same token to another device that uses the same industry standard? It's not any different than a variation of a "Pass the Hash" issues encountered in our current computing culture.

      Moreover, most biometric safeguards implemented today are run on top of existing authentication schemes. Do you think when you scan your fingerprint that it sends your fingerprint data to active Directory to authenticate? Doubtful. The application validates you finger print locally and then Authenticates you in an existing method i.e Kerberos, or whatever. Most Biometrics are just macros that type in your password for you behind the scenes.

      In theory only one device should be able to reproduce those waves..your brain. Just like you should be the only one with access to your private keys. But I am a firm believer that anything that requires input can be tricked into accepting false inputs. Even Dildo's are a falsified input which will usually "authenticate" on the correct biometric systems.

  25. Gets messy by Anonymous Coward · · Score: 0

    OK, so my passthought is "boobs".
    It works fine for awhile.

    Then, it stops working.
    I call the service desk.
    Service Desk: How can I be helping you today?
    Me: My passthought doesn't work.
    Service Desk: Can you turn it off and on?
    Me: it is a thought. I use it to logon.
    Service Desk:What thought are you thinking?
    Me: boobs.
    Service Desk: Are you thinking about boobs?
    Me: Yes boobs.
    Service Desk: What kind of boobs can I help you with today?

  26. Password reuse by arielCo · · Score: 2

    Who thought up this? Mordac the Preventer of Information Services?

    Concentrate on a new passthought ...

    Don't kill the Security guy. Don't kill the security guy.

    Error: You cannot use any of your last 3 passthoughts.
    Error: Your passthought is too common.

    GRAAAAH!!

    Error: Your passthought is too common.

    --
    This post contains no rudeness or derision of any kind. All arguments are friendly. Terms and exclusions may apply.
  27. Stay-Puft Marshmallow Man. Enough said. by Anonymous Coward · · Score: 0

    History will repeat itself. Stay-Puft Marshmallow Man. Enough said.

  28. Old idea by Anonymous Coward · · Score: 0

    I had this idea at a Usenix conference back in 2001. It's not new.

  29. Crimson Eleven Delight Petrichor by wonkey_monkey · · Score: 1

    Crimson Eleven Delight Petrichor

    --
    systemd is Roko's Basilisk.
  30. The brain changes by degeneratemonkey · · Score: 2

    It would be interesting to see the results of an experiment which brings the same subjects back in 5 or 10 years and asks them to think the same passthoughts. I highly doubt as much accuracy would be observed.

    This is however an easy problem to solve: just change your passthought every few months.

  31. Ohh Joy by Servercide · · Score: 1

    Another cool toy that will input your NTLM password for you....

    1. Re:Ohh Joy by Servercide · · Score: 1

      Also...what if you IQ is too low to generate an acceptable password?

  32. what could possibly go wrong? by kimvette · · Score: 1

    Unless it works with migraines, cluster headaches, stress, anxiety, depression/grief, happiness, exhaustion, pain, and a slew of other conditions that affect brainwave patterns (heck, even caffeine can throw off brainwave patterns) this is too error prone to be reliably used.

    --
    The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
  33. Just remember.... by maroberts · · Score: 1

    ..to think in Russian....at least if unlocking Firefox.

    --

    Donte Alistair Anderson Roberts - hi son!
    Karma: Chameleon

  34. It's just an input device by Anonymous Coward · · Score: 0

    Ease of use is definitely enhanced, but there's really not much increase in security to be had here: if a hardware device reads a "passthought", chances are that its just going to encode the string with some one-way hash function, which then gets stored in a password database using some other one-way hash function. From an intruder's perspective, this is a solved problem: keyspace exhaustion attacks defeat the one-way hash function by trading time for memory.

    Aside from getting rid of common passwords, and increasing average password string-length (which can't be much longer without intolerably increasing the demands on auth server CPUs), this method is not much more secure than regular passwords, as circumventing it will simply require a rainbow table for the hash, and a modified client-side eeglib.so, or what-have-you, that reads the EEG device.

  35. In other news... by Yakasha · · Score: 1

    Apples shares plummeted 14% in after hours trading today as the company continues to battle their network security problems. Details are still forthcoming, but it appears their main campus is still closed, with the employees milling about in the parking lot. It is believed to be related to their roll-out of a new Electroencephalographic (EEG) based security system. One anonymous executive said, "Ya, looks like the 'think different' campaign really backfired."

  36. On the up side by Yakasha · · Score: 1
    No more drug tests!

    "Bob can't login must be high again..."

  37. Defeats the point of a password..... by Anonymous Coward · · Score: 0

    Doesn't this defeat the purpose of a password/passphrase? Think about it, now all the government or anyone has to do to get your password is bring you to the scanner and say don't think of your password, or what is your password, etc. It will be very difficult for people to NOT think of their password, so the people you want to keep out will have even easier access than they would have had with a normal password system. I am not a fan of any biometric password systems, it is simply too easy to force me to let you in in those systems. Finger prints? No problem cut off my finger or find my prints and create fake digits with those prints. Brainwaves? Just hook my brain up to a scanner. Iris, force me to open my eye or just remove it from my head. If you think that the FBI wouldn't force you to hook your brain up to the scanner to get your password you are naive and living in a dream world. These types of security measures make us less secure.

    AlphaA

  38. Already read that book.... by sgt_doom · · Score: 1

    One title comes to mind, Brian Falkner's Brain Jack......

  39. Not a word. by RightSaidFred99 · · Score: 1

    I see a lot of people talking about thinking a word. That's so 1965.

    Instead, you'd remember what your house looks like. Or think about the time your kid said something cute. Or imagine an impossible spring that actually becomes less resistant as you apply pressure.

    Something like that, not "Durr, 'BoogieMan2008!'".