Slashdot Mirror
Banks and Retailers Are Tracking How You Type, Swipe and Tap (nytimes.com)
When you're browsing a website and the mouse cursor disappears, it might be a computer glitch -- or it might be a deliberate test to find out who you are. The way you press, scroll and type on a phone screen or keyboard can be as unique as your fingerprints or facial features. To fight fraud, a growing number of banks and merchants are tracking visitors' physical movements as they use websites and apps. From a report: Some use the technology only to weed out automated attacks and suspicious transactions, but others are going significantly further, amassing tens of millions of profiles that can identify customers by how they touch, hold and tap their devices. The data collection is invisible to those being watched. Using sensors in your phone or code on websites, companies can gather thousands of data points, known as "behavioral biometrics," to help prove whether a digital user is actually the person she claims to be. To security officials, the technology is a powerful safeguard. Major data breaches are a near-daily occurrence. Cyberthieves have obtained billions of passwords and other sensitive personal information, which can be used to steal from customers' bank and shopping accounts and fraudulently open new ones.
The permissions will become more granular to allow users who care to lock down what apps can access certain sensors and data.
I audit my app permissions regularly and disable anything that I don't think the app needs.
Until that happens, though, I can just not use my banking app from my phone.
My eyes reflect the stars and a smile lights up my face.
Funky.
The way I browse/type/click, I'm surprised I haven't been brought in for some sort of evaluation by now.
I don't have cable, just a notebook in the garage, connected to my 60 inch TV where I watch all my legal and illegal stuff.
When I'm too lazy to reach for the keyboard, I just use the onscreen one with the mouse, either with my left or right hand, depending on what I'm doing at that time.
I doubt that they recognize me that way.
Seriously though... has it occurred to them that they may end up denying people's transactions at critical moments of stress due to behavioral differences. Like, I really need to get this hotel room after walking 5 miles in sub-zero weather from my dead car, but I can't transfer goddamn money to checking?
Someone had to do it.
We're doing this for your protection, citizen, and you should be grateful that we're looking over your shoulder to ensure that you're not being defrauded!
GET YOUR NOSE OUT OF MY BUSINESS, YOU ASSHOLES.
Yet another reason I'll never own a smartphone.
We can identify banks by how much vaseline they had to use to screw us up the arse.
they know it's not me if the browser runs their scripts
In God I trust all others are subject to review...
errr....umm...*whooosh* *whoosh* Is this thing on ?
Why not use a credit card?
Oh right. Your phone. I keep forgetting. A phone is the only way to do transactions any more.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
So, I get a little lazy and they accuse me of not being me. Or a more lazy and sloppy than usual. That's okay, at least THEY have my money.
And some people claim there's a market for smart guns and other biometric devices that are specifically intended not to work as intended, when intended.
Research shows that 67% of those who use the term "research shows", are just making shit up.
All the big sites are doing this. There are at least a dozen analytic tools capable of doing mouse tracking and heatmaps; full journey tracking will be next. Hotjar, mouseflow, smartmove, inspectlet are just a few off the top of my head.
...representing my typing, scrolling, swiping, how difficult would it be to programmatically mimic me?
My point is that this extra verification step may come at an extremely inconvenient or stressful time, and may in fact be a big deal in some situations, adding more stress or delay to an already tenuous situation. And given the metric they are using, the likelihood of it kicking in at just those times is much higher than its general-case probability.
Someone had to do it.
Your bank, and other web sites you log into, are trying to determine whether the person trying to log in as "nospam007" really is you - the same person who logged into your account the last eight times.
If you consistently use a weird setup, that makes it so much easier. Unless the hacker trying to access your account also uses the on-screen keyboard on a 60" TV, it's really easy to tell the difference.
What's less useful is when people use a very common set-up, with all defaults, and only the most common plugins. That makes it harder to tell the difference between the account holder and someone else trying to access their account.
I'm speaking as someone who developed a system like this ten years ago. For several years it was the most-used security system, used on the largest number of web sites. I've since taken a corporate job with a much larger company.
Once this is stolen, then the bad guys will also have all this information. Matter of time.
I was thinking something slightly less blunt, like "I've got 150 seconds to do this transaction or I miss my flight out of the country and the local mafia is hot on my heels for that expose I wrote for the AP." But OK.
Someone had to do it.
Why not use a credit card?
Oh right. Your phone. I keep forgetting. A phone is the only way to do transactions any more.
The credit card got blocked due to fraud detection.
Hollow earthers. We don't talk about them.