4 ms·
How many people were there? Did he have any way of estimating the entropy of the signatures? Did you try the demo over multiple days, and at different times of
by mistercow 14y ago
How many people were there? Did he have any way of estimating the entropy of the signatures? Did you try the demo over multiple days, and at different times of day, to see if it continued to identify you correctly?
>it's only drawback is the lack of necessity
No, that's not the only drawback. Be very careful when talking about cryptography and security never to assume that you are aware of all of the weaknesses unless you've got a formal proof.
One very big drawback I can think of off the top of my head is that it would essentially be like having the same password everywhere, and being completely unable to change that password. If someone records your typing style once, they will be able to get to absolutely everything that identifies you based on typing style. At least with retina scans and fingerprints, there are mechanical obstacles to producing a facsimile.
- wwwhizz 14y agoEven if you've got a formal proof, you need to keep aware of weaknesses, they might be in your proof, or even outside it.
- mistercow 14y agoThat's true. Proofs rely on assumptions, and in the real world, those assumptions may hold in all cases. Failing to recognize that will lead you to thinking very silly things, like that that Gödel's incompleteness theorems have deep philosophical implications.
- eliasmacpherson 14y agoAs an extra layer of security, not the 'singular' layer of security, the drawback you mention doesn't apply. It would have uses outside security too, for example user identification and profiling purposes on websites. I often wonder about sites where users usually type in content, and what information could be gleaned about users by their operators.
- Zimahl 14y agoWe had 5 or so people playing with it over a couple days. We didn't have any insight into the code - how often it polled, how much it changed, the window of valid keystrokes, etc. - just the ability to use the demo software and see various metrics. You're right, it's not the only drawback. I just meant that there are many vectors of attack when it comes to network security and so many fail at those that this might be less gain than one might assume at first thought.