Slashdot Mirror
Chrome Extension Thwarts User Profiling Based On Typing Behavior
An anonymous reader writes: Per Thorsheim, the founder of PasswordsCon, created and trained a biometric profile of his keystroke dynamics using the Tor browser at a demo site. He then switched over to Google Chrome and not using the Tor network, and the demo site correctly identified him when logging in and completing a demo financial transaction. Infosec consultant Paul Moore came up with a working solution to thwart this type of behavioral profiling. The result is a Chrome extension called Keyboard Privacy, which prevents profiling of users by the way they type by randomizing the rate at which characters reach the DOM. A Firefox version of the plugin is in the works.
Seems like a theoretical problem with a theoretical solution. Just because they found one mechanism does not mean that there is not another. Just because they were able to do it in a controlled environment does not mean that others can or will. It seems a lot of effort to actually get fairly trivial information. Most browsers are fairly uniquely fingerprinted anyhow. There are easier ways to track (and likely more certain ways) so this seems like a non-starter without more information and more prevalence.
"So long and thanks for all the fish."
Where is the licensing agreement?
Smart solution for a problem that actually does not exists?
That's mechanical use of keyboard, but you're also gonna need a phrase anyzer and commonizer. Grammar and phrases used by writers should be unique enough to identify the same anonymous writers on different sites, at least over the long run.
If you can tie a controversial anon to a known account like facebook, you can then go all SJW on him, outing them to their employer and getting them fired.
I am less concerned about racist assholes than more general political opinions and so on.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
The term "pissing in the ocean" comes to mind.
Locked out of everything, hooray!
Simple problem, simple solution.
I don't order my crack and guns using Chrome.
Am I surprised that this can be done? No. But DO-NOT-ALLOW-SCRIPTS in your browser if you are truly attempting to be secure.
Silence is a state of mime.
Why would anyone use this spyware anyway? Just use Firefox, or even modern versions of IE is better
Instead, sites will be able to identify him as one of the 25 people in the country who use this extension.
www.behaviosec.com.
A little known, little used site is able, after some training, to identify a person from a very small pool of users. I dunno. Employ this on very busy site with thousands of users, and then we can see how accurate it is.
Reading the article the extension does the right thing and actually modifies the timings to be constant (50ms between key presses by default). By setting the timings to always be the same, all users of the extension look identical. Adding random noise as it sounded like the summary was describing tends to be ineffective against timing attacks because it averages out.
There's something truly backward about the web if we have to go back to plain old web pages because of all this.
vive la links!!
Why would you make an anti-tracking feature for a browser only made to track you? Whatever you do you are still being tracked by default, that is the point of Chrome.
> by randomizing the rate at which characters reach the DOM
Just do what IE11 does and randomly don't send some characters to the DOM.
Most linux users don't know this, but the man pages were named after Chuck Norris. Chuck Norris fsck'ing hates noobs!
The irony...