4 ms·

I think it's helpful to think of two components to any sort of authentication, external and internal characteristics of identity. External identity in that the

I think it's helpful to think of two components to any sort of authentication, external and internal characteristics of identity. External identity in that the individual attempting to log in has characteristics that are limited to the individual who was granted access. This is not provided by the login name, to be clear, but by the authentication means (biometric etc). Unfortunately biometrics can be copied... and if copied, generally can't be changed. So external identity authentication is brittle. Internal identity in that the individual intending to log in demonstrates behavior consistent with the knowledge or mental state of the individual who was granted access. When the person enters in something they uniquely know, they are demonstrating something more then having a characteristic associated with their identity like a fingerprint. This is better, but still faces risks, especially when the internal identity authentication method is based on something which is outside the user's choice. Biometrics prove external identity, but not internal identity, which can be problematic, in that fingerprints can be copied much easier then things in people's head. There are others issues with external identity, in that characteristics change. If I'm a DEA agent and get shot in the throat while undercover, even if I recover my voiceprint may be entirely different. If I get a papercut, my fingerprint might not scan. And so on. As I said, there can be faulures in internal identity too. Asking set security questions means that the mental state can become known to attackers. If every website asks about favorite teachers, pet names, mother's maiden names etc. Then a User who fills out the security questions at a seemingly legit website is compromising their internal identity authentication. Or a user who is doing something different, or whatever may fall afoul of an automated program that analyzes their typing. Switching to Dvorak could mean losing access to your account. That's why passwords/pass phrases are in many ways better then any alternative I've seen so far. Because they are chosen by the user to be something secret, security conscious people know not to use their birthday or other dates of importance to them. Passwords/phrases are either known or unknown... you simply compare them, or more likely their hash, to what's stored in your shadow file, password database. It's pretty hard to have one's passphrase learned surreptitiously by recording the user's voice, or stealing a glass with their fingerprint to rub gummyworms on. This keystroke analysis though... it ignores two possibilities. 1. is that some incident effects keystroke length like an injury. 2. Is that the individual's keystroke method could be learned from their activity elsewhere, like their security question answers can be learned, and an intermediate device used to change the unauthorized user's keystrokes into those that match the authorized user. I wish I had an alternative suggestion that was awesome and fixed such issues. About the only thing I can think to improve security is to combine methods. I like sci fi, and maybe at some point centuries from now people will be able to do PGP mentally with nanotechnology or something fanciful like that. But by then I expect that there will be possible attacks to counter such authentication.

DanBC 15y ago
> This keystroke analysis though... it ignores two possibilities. 1. is that some incident effects keystroke length like an injury. But it's a suggestion that something might be wrong, and that extra checks are needed. The article mentions using a webcam or sending a security guard around to check. (Obviously, this only works for internal office security and is hopeless for people working from home) > 2. Is that the individual's keystroke method could be learned from their activity elsewhere, like their security question answers can be learned, and an intermediate device used to change the unauthorized user's keystrokes into those that match the authorized user. I'd be interested to know how much data someone would need to build a successful keystroke-impersonator. And then where would they capture that data? And there are really big problems with passwords; they're asked for in all sorts of places, and people don't bother using secure passwords even in the important places. There's not that much research about passwords, especially considering how much money is controlled with them.
- magic_haze 15y ago
  A standard keylogger would do the trick, I guess: just store the timestamp along with the key pressed, register yourself to the OS as a keyboard device and then replay the keys back. How hard could that be? The only plausible response I can think of is to go the HDMI route and force keyboard manufacturers (and the OS) to only recognize cryptographically sound connections.

DanBC 15y ago

> This keystroke analysis though... it ignores two possibilities. 1. is that some incident effects keystroke length like an injury. But it's a suggestion that something might be wrong, and that extra checks are needed. The article mentions using a webcam or sending a security guard around to check. (Obviously, this only works for internal office security and is hopeless for people working from home) > 2. Is that the individual's keystroke method could be learned from their activity elsewhere, like their security question answers can be learned, and an intermediate device used to change the unauthorized user's keystrokes into those that match the authorized user. I'd be interested to know how much data someone would need to build a successful keystroke-impersonator. And then where would they capture that data? And there are really big problems with passwords; they're asked for in all sorts of places, and people don't bother using secure passwords even in the important places. There's not that much research about passwords, especially considering how much money is controlled with them.

magic_haze 15y ago
A standard keylogger would do the trick, I guess: just store the timestamp along with the key pressed, register yourself to the OS as a keyboard device and then replay the keys back. How hard could that be? The only plausible response I can think of is to go the HDMI route and force keyboard manufacturers (and the OS) to only recognize cryptographically sound connections.