Passthoughts, Not Passwords: Authentication Via Brainwaves
CowboyRobot writes "A new study by researchers from the U.C. Berkeley School of Information examined the brainwave signals of individuals performing specific actions to see if they can be consistently matched to the right individual. To measure the subjects' brainwaves, the team utilized the NeuroSky Mindset, a Bluetooth headset that records Electroencephalographic (EEG) activity. In the end, the team was able to match the brainwave signals with 99% accuracy (pdf). 'We are not trying to trace back from a brainwave signal to a specific person,' explains Prof. John Chuang, who led the team. 'That would be a much more difficult problem. Rather, our task is to determine if a presented brainwave signal matches the brainwave signals previously submitted by the user when they were setting up their pass-thought.'"
Great, now anyone walking by can lock out my account with failed auth attempts
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
I'm afraid that wouldn't work for several of my past managers. Heey-oh!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I'll tell you what to think! ;)
http://xkcd.com/538/
thoughtcrime is comeing
"I thought my passthought. But maybe I didn't think it the right way. Let me try again..."
Just what we need, an even more complicated and harder to use apparatus with a reduced probability of correctly identifying the right user.
Since when is "works correctly 99% of the time" good enough for an authentication system?
So first we had passwords. Then they invented fingerprint readers so now everyone can log in with either a fingerprint or a password as a backup in case the fingerprint reader doesn't work. Obviously 2 ways of getting into a system is MUCH more secure. Same here. I bet this will be backed by a password.
What If you make a happy thought of your girlfriend and then breakup with her? You can't form that joyful thought anymore, can you still unlock it afterwards?
Helpdesk,
I need help logging in. I have a migraine and can't get my passthought right. Can you send up two aspirin tablets.
Thanks
the growth in cynicism and rebellion has not been without cause
So now every time I want to gain access I have to think the same thing I thought when I first entered the passthought.
"Okay, no thinking of naked girls now, anything but naked girls. Betty White! Yes, Betty White completely dressed, dressed in sexy lingerie... oh god, not that either, that's horri*".
"thank you, passthough recorded".
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
The current headset is unwieldy. Would the banks make you put on a headset and think "i am the real me" when you get to the teller's station instead of signing on the electronic signature pad?
Please try another thought password. "Tits" is not sufficiently secure.
Have gnu, will travel.
It would be very difficult to hack a brainwave interface with a brain dead head.
How the hell do they expect me to do password resets now?
I'm sure that Dremel will come out with an attachment for that.
You may think me a tired, old, cynic. I'd have to disagree about the tired bit.
So now everyone who watches Doctor Who will set their passwords to "Crimson, Eleven, Delight, Petrichor".
At least it'll be easy to get into my wife's computer.....
"My brain is my password. Verify me".
OTOH... Since that can't be recorded on a tape, it gets kinda messy.
Again, brain dead...
Who thought up this? Mordac the Preventer of Information Services?
Concentrate on a new passthought ...
Don't kill the Security guy. Don't kill the security guy.
Error: You cannot use any of your last 3 passthoughts.
Error: Your passthought is too common.
GRAAAAH!!
Error: Your passthought is too common.
This post contains no rudeness or derision of any kind. All arguments are friendly. Terms and exclusions may apply.
Crimson Eleven Delight Petrichor
systemd is Roko's Basilisk.
Brains change over time, but such change is ordinarily slow enough that if you are keeping the database of what the person's current brain waves look like up to date, then such normal evolution would not be a problem.
The only time it would be is on account of certain types of trauma, which can very abruptly and very quickly change a person's thought patterns.
File under 'M' for 'Manic ranting'
It would be interesting to see the results of an experiment which brings the same subjects back in 5 or 10 years and asks them to think the same passthoughts. I highly doubt as much accuracy would be observed.
This is however an easy problem to solve: just change your passthought every few months.
You can record their brainwaves, but how do you reproduce them to another device that records them?
File under 'M' for 'Manic ranting'
Another cool toy that will input your NTLM password for you....
You don't reproduce them. You just record your interpretation of brainwave sequences. Then that interpretation can be passed on. Like the mp3 of the brainwave world. All you need is one way communication.
But it might be quite easy with a live head. If you can intercept the signal, you can reproduce it. And intercepting a bluetooth signal should not be that hard. The problem is that it takes some "middle man hardware" to get the brainwaves into the computer. And middlemen can be a lot easier to fake. It is a bit like voice recognition: the voice may be personal and unique (or personal and unique enough), but recording a voice and playing it back is dead easy.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
You sure? If this proves "secure", say for a doomsday device to be activated only by the president, it would require the president to have his brainwaves recorded periodically. And each recording is an opportunity to breach the system. And if the shit really hits the fan, he might be too upset to authenticate (which, in this particular case, would be a good thing).
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
Uhm.... if you're not reproducing them, how would you get into somebody's system that used this type of authentication? Sure, you can record their brainwaves while they are thinking whatever it is they need to think, but how on earth would that recording actually help *you* get into their system, which only records brainwaves?
File under 'M' for 'Manic ranting'
perfect!
... keeps your system safe from managers :-)
Unless it works with migraines, cluster headaches, stress, anxiety, depression/grief, happiness, exhaustion, pain, and a slew of other conditions that affect brainwave patterns (heck, even caffeine can throw off brainwave patterns) this is too error prone to be reliably used.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
Same way you should be doing it now - require them to be physically present with proof of identity. Or do you reset passwords in response to any random email/phone request that sounds like it came from the authorized account holder?
--- Most topics have many sides worth arguing, allow me to take one opposite you.
That means I am as well *sob*
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
..to think in Russian....at least if unlocking Firefox.
Donte Alistair Anderson Roberts - hi son!
Karma: Chameleon
It is a bit like voice recognition: the voice may be personal and unique (or personal and unique enough), but recording a voice and playing it back is dead easy.
And yet people remain fascinated with these unchangable, non-repudiatable, easily spoofed means of biometric identification. I really don't get it.
Blasphemy is a human right. Blasphemophobia kills.
Apples shares plummeted 14% in after hours trading today as the company continues to battle their network security problems. Details are still forthcoming, but it appears their main campus is still closed, with the employees milling about in the parking lot. It is believed to be related to their roll-out of a new Electroencephalographic (EEG) based security system. One anonymous executive said, "Ya, looks like the 'think different' campaign really backfired."
"Bob can't login must be high again..."
assuming there is some sort of wireless receiver from the phone with EEG sensors (hopefully not BT) that sends the brain signal over... record replay!!?
Well, to be useful in a computing environment you would have to convert the analog brainwaves into a digital format. Now, we can pretend that each and every manufacturer will have their own proprietary way of digitally converting these waves. Or, We can pretend that there will be an industry standardized format for converting analog brainwaves into a digital format (this is the more likely case IMO).
So, your Brainwave Pattern + Industry Standard Conversion = Valid Authentication Token. What is keeping me from taking that same token to another device that uses the same industry standard? It's not any different than a variation of a "Pass the Hash" issues encountered in our current computing culture.
Moreover, most biometric safeguards implemented today are run on top of existing authentication schemes. Do you think when you scan your fingerprint that it sends your fingerprint data to active Directory to authenticate? Doubtful. The application validates you finger print locally and then Authenticates you in an existing method i.e Kerberos, or whatever. Most Biometrics are just macros that type in your password for you behind the scenes.
In theory only one device should be able to reproduce those waves..your brain. Just like you should be the only one with access to your private keys. But I am a firm believer that anything that requires input can be tricked into accepting false inputs. Even Dildo's are a falsified input which will usually "authenticate" on the correct biometric systems.
One title comes to mind, Brian Falkner's Brain Jack......
well they could encrypt the data being transmitted by the wireless headset and have the key change over time to prevent record and playback attacks, or just hardwire it.
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
Spoken like a true BOFH.
Who cares that they chop off the heads of our users, as long as they aren't getting into the system.
Because a computer is worth more than a human life.
Objection! Assumes facts not in evidence!
OP clearly said "users."
Moderate drunk! It's more fun that way!
I see a lot of people talking about thinking a word. That's so 1965.
Instead, you'd remember what your house looks like. Or think about the time your kid said something cute. Or imagine an impossible spring that actually becomes less resistant as you apply pressure.
Something like that, not "Durr, 'BoogieMan2008!'".