6 ms·
"the timings of and between key presses are unique to each person". I wonder if there are more of these "features" and how many would take to build up a online
by razorsese 10y ago
"the timings of and between key presses are unique to each person".
I wonder if there are more of these "features" and how many would take to build up a online profile of an user consistent regardless of the hardware used.
- GarrisonPrime 10y agoThankfully I already switch to the hunt-n-peck method when using a public computer, access point, or VPN. Now I just need to learn Dvorak...
- kardos 10y agoSuch that you can be tracked by your hunt-n-peck timings?
- gcr 10y agoYeah. I bet there aren't many hunt-n-peck Dvorak typists in the world. It should be easy to determine.
- GarrisonPrime 10y agoSure, that would be an issue. They tend to vary quite a bit more than my regular typing though. And I often go weeks or months without hunt-n-pecking, so it's really not a practiced method with a consistent timing.
- collyw 10y agoSurely unique timings would still be unique using Dvorak.
- GarrisonPrime 10y agoSurely. But that assumes they consider the possibility I'm using Dvorak. And if I switch which keyboard layout I'm using it'll help more. (But honestly that's likely to be too much bother and I wouldn't follow through with that practice.)
- Klathmon 10y agoSo I saw that their planned "fix" was to introduce random latency to the key presses to hide the true timings, but does that really help anything? When it comes to timing attacks in things like decryption or password comparisons, I thought random latency was a pointless addition as it only requires a bit more sampling before you can pull the underlying differences out. Does it work in this instance just because the numbers involved are a few magnitude less would be with something like network requests?
- relate 10y agoI would have thought the same. However instead of adding random latency, one could have a buffer, that only allows a couple of fixed output rates (eg, 150,160,...,300 CPM), when typing. This would probably be quite annoying to type on though :-)
- amelius 10y agoThe best solution would probably be to have the HTML input field not fire events for key down.
- imagist 10y agoIt's fairly easy to create a div which behaves the same way as a HTML input field, and there are other ways. Ultimately I think you'd have to not fire key events, period.
- mjevans 10y agoAgreed, you'd have to fire string input rates, and defer the underlying update until either enough buffer has entered to warrant a mid-point sync, or input has paused for a decent length of time. (say 10s) For 'hardened' browsers I'd recommend a visual indication of this timeout (a pie chart which completes like a clock at a fixed rate while paused is the first concept that I think of).
- p4bl0 10y ago
- strictnein 10y agoInterestingly, Coursera uses these timings to authenticate that it is really you taking a quiz for one of their courses.
- otoburb 10y agoMost of the Coursera courses I took gave quizzes that were mainly multiple choice, this limiting the availability of a keystroke-corpus to identify the user. Curious if this has changed recently to warrant this comment as the last course I took was a while ago.
- strictnein 10y agoYeah, they're still multiple choice. They have you type a phase before you take the quiz. At the start of the course they have you type the phrase once or twice to get your cadence and then take your picture afterwards.