I think the aim of this project is misguided. Next to the many excellent points that have been raised in response to this article, there's one that I think is a

I think the aim of this project is misguided. Next to the many excellent points that have been raised in response to this article, there's one that I think is a killer for its practicality, based on the article below (which was featured a few weeks back): http://motherboard.vice.com/read/lego-driven-robot-programmed-to-hack-touch-screen-authentication-systems http://motherboard.vice.com/read/lego-driven-robot-programme... I think techniques such as used in the above article, that create "ultra-generic power-user" of the users of a device, will be quite difficult to protect against through measures such as announced by Google with Trust API. The Lego robot from the above article could only be effective because it knew their user's swiping pattern, without this knowledge, the model would have failed miserably, in a very easy binary decision (is the pattern equal to the original pattern). Now that Google is effectively making everyone's "swiping pattern" uniform, these techniques will become a lot more effective. Not only in the test phase, but the training phase as well. The ultra-generic power user model was derived from 41 users who each had different swiping patterns. To me, it seems that this would be made a lot easier if every user had the same pattern. A Biometric classifier for a person A tries to distinguish between behaviour that did come from person A, and behaviour that did not come from person A. This, in one way, can be seen as measuring the distance in some highly dimensional behavioural space between the average/nearest of all data points that DO belong to person A, and balancing that against the distance between the average/nearest of all points that DO NOT belong to Person A. Presumably, ultra-generic users are somewhere in the middle on this and muddle the water a lot. These ultra-generic users are likely much closer to A then a random person who is not A will be. Best of all, unless in the unlikely case that person A is a super special snowflake, the model can be trained offline, on persons who are not even A! So in order for person A to be able to sufficiently distinguish itself from ultra-generic power user B, A needs to have a secret password again..