4 ms·
I built some network security software in the early part of the 2000s. Around 2005, a local guy built a keystroke pattern recognizer utilizing neural networks
by Zimahl 14y ago
I built some network security software in the early part of the 2000s. Around 2005, a local guy built a keystroke pattern recognizer utilizing neural networks to learn your keystrokes and was able to correctly identify who you were after a minimal amount of learning (typing). He brought it buy to see if we were interested in licensing it and using it in our product.
While somewhat of a black box demo, we were able to play with the technology. We tried a ton of stuff to fool the system (physical only, we didn't use keystroke macros or anything like that) and it would correctly identify us every time. It was showing us the probabilities as they'd change and it was uncanny how it would immediately know that I started typing instead of a coworker.
So, it's not only probable/possible/exists, it's only drawback is the lack of necessity. Outside of the the highly paranoid using it to prevent outside intrusions (government mostly), not many systems need it due to lower-end attacks that are much easier to do and typically successful enough.
- mistercow 14y agoHow many people were there? Did he have any way of estimating the entropy of the signatures? Did you try the demo over multiple days, and at different times of day, to see if it continued to identify you correctly? >it's only drawback is the lack of necessity No, that's not the only drawback. Be very careful when talking about cryptography and security never to assume that you are aware of all of the weaknesses unless you've got a formal proof. One very big drawback I can think of off the top of my head is that it would essentially be like having the same password everywhere, and being completely unable to change that password. If someone records your typing style once, they will be able to get to absolutely everything that identifies you based on typing style. At least with retina scans and fingerprints, there are mechanical obstacles to producing a facsimile.
- wwwhizz 14y agoEven if you've got a formal proof, you need to keep aware of weaknesses, they might be in your proof, or even outside it.
- mistercow 14y agoThat's true. Proofs rely on assumptions, and in the real world, those assumptions may hold in all cases. Failing to recognize that will lead you to thinking very silly things, like that that Gödel's incompleteness theorems have deep philosophical implications.
- eliasmacpherson 14y agoAs an extra layer of security, not the 'singular' layer of security, the drawback you mention doesn't apply. It would have uses outside security too, for example user identification and profiling purposes on websites. I often wonder about sites where users usually type in content, and what information could be gleaned about users by their operators.
- Zimahl 14y agoWe had 5 or so people playing with it over a couple days. We didn't have any insight into the code - how often it polled, how much it changed, the window of valid keystrokes, etc. - just the ability to use the demo software and see various metrics. You're right, it's not the only drawback. I just meant that there are many vectors of attack when it comes to network security and so many fail at those that this might be less gain than one might assume at first thought.