4 ms·

We use this concept for low friction enterprise authentication at SecureAuth. Sure as hell beats rsa tokens or anything related to a phone.

dmix 13y ago
Could you explain how it would work? The user signups up, connects their phone to their account and you use the fingerprint as the ID for future validation? How do you handle changes in fonts/plugins/browser versions/timezones while travelling. All of that data seems to be muteable over time. Unless it's a 99% match kind of thing. Also what about companies that hand out laptops with the same base OS/browser-installs (or is that the goal)?
- chayesfss 13y ago
  Client side changes are handled in a weighted model. If the heuristics match between 85 and 95% we might update the stored fingerprint. While we can use this for SSO it's usually tied to another factor of authentication. Something like a user/pass, social id or maybe saml assertion from another claim provider. We are just scratching the surface of what this type of technology can be used for.
  - X4 13y ago
    sounds awesome and at the same time it's shocking how unique and identifiable we are online. Did you consider adding _buzz_and_words_here_ 3-Factor Auth (4-Factor for Gov. clients)? You could solve it in a way that makes it very comfortable to the user, yet very hard to crack for crackers. 1. Your Tracking Technique + DRM-based-License Tracking 2. One Password / ID (No username required, it's optional) 3. Typing Speed Tracking 99.5 percent accuracy [1] 4. (Bio-metric Data like Fingerprint or HD Iris Scans for Gov. Clients) DARPA is also working on it, definitely watch this (Google alredy uses this!): http://www.youtube.com/watch?v=fgNpOzvwOiU http://www.youtube.com/watch?v=fgNpOzvwOiU [1] http://csis.pace.edu/~ctappert/it691-08fall/projects/keystroke-bookchap.pdf http://csis.pace.edu/~ctappert/it691-08fall/projects/keystro... Dude, you made me curious, I will implement this after my thesis! :) (I'm watching you DARPA et. al /24/7/365!)
    - chayesfss 13y ago
      Yeah we provide the solution to a lot of government clients. Strange enough, our international clients like the 3 or 4 factor authentication. It's very very easy for us to do though as there's no limit to chaining the work flows together.
      - X4 13y ago
        Can you already offer 3. as a service, is it in planning, or won't you use that?
        chayesfss 13y ago
        Yes, 3, 4, what ever they want we already offer
0x0 13y ago
What? Wow, that sounds really dangerous. The same fingerprint is available to any site out there, so anyone could just capture it and try to replay it on a "SecureAuth" service, no?
- deleted 13y ago
  [deleted]
- samweinberg 13y ago
  Hopefully that isn't the only mean of authentication.
  - 0x0 13y ago
    What is it then? What if I upgrade the browser, will it accept whatever other auth factor I present (a password?) anyways? What's left then?
- chayesfss 13y ago
  Here's how it works. As a user I want to connect to a web resource, I am redirected to my idp (SecureAuth) where we ask you your name, then I look at your account and ask you to enroll, then I ask you your password. Now before I generate a claim/token or what ever I take your fingerprint so for the next day/30 days/90 days or what ever your fingerprint is checked between your username/password and the strong authentication is transparent to the user. The variables can all be weighted differently and the fingerprints can easily be revoked but it is very cool technology.
MartinCron 13y ago
I also used a similar concept to help us investigate charges of of cheating in an asynchronous online strategy game where sock-puppet collusion would destroy the balance. Having an extremely high probability that two accounts are actually the same browser made it easier for us to warn|block|ban cheaters.

dmix 13y ago

Could you explain how it would work? The user signups up, connects their phone to their account and you use the fingerprint as the ID for future validation? How do you handle changes in fonts/plugins/browser versions/timezones while travelling. All of that data seems to be muteable over time. Unless it's a 99% match kind of thing. Also what about companies that hand out laptops with the same base OS/browser-installs (or is that the goal)?

chayesfss 13y ago
Client side changes are handled in a weighted model. If the heuristics match between 85 and 95% we might update the stored fingerprint. While we can use this for SSO it's usually tied to another factor of authentication. Something like a user/pass, social id or maybe saml assertion from another claim provider. We are just scratching the surface of what this type of technology can be used for.
- X4 13y ago
  sounds awesome and at the same time it's shocking how unique and identifiable we are online. Did you consider adding _buzz_and_words_here_ 3-Factor Auth (4-Factor for Gov. clients)? You could solve it in a way that makes it very comfortable to the user, yet very hard to crack for crackers. 1. Your Tracking Technique + DRM-based-License Tracking 2. One Password / ID (No username required, it's optional) 3. Typing Speed Tracking 99.5 percent accuracy [1] 4. (Bio-metric Data like Fingerprint or HD Iris Scans for Gov. Clients) DARPA is also working on it, definitely watch this (Google alredy uses this!): http://www.youtube.com/watch?v=fgNpOzvwOiU http://www.youtube.com/watch?v=fgNpOzvwOiU [1] http://csis.pace.edu/~ctappert/it691-08fall/projects/keystroke-bookchap.pdf http://csis.pace.edu/~ctappert/it691-08fall/projects/keystro... Dude, you made me curious, I will implement this after my thesis! :) (I'm watching you DARPA et. al /24/7/365!)
  - chayesfss 13y ago
    Yeah we provide the solution to a lot of government clients. Strange enough, our international clients like the 3 or 4 factor authentication. It's very very easy for us to do though as there's no limit to chaining the work flows together.
    - X4 13y ago
      Can you already offer 3. as a service, is it in planning, or won't you use that?
      - chayesfss 13y ago
        Yes, 3, 4, what ever they want we already offer

0x0 13y ago

What? Wow, that sounds really dangerous. The same fingerprint is available to any site out there, so anyone could just capture it and try to replay it on a "SecureAuth" service, no?

deleted 13y ago
[deleted]
samweinberg 13y ago
Hopefully that isn't the only mean of authentication.
- 0x0 13y ago
  What is it then? What if I upgrade the browser, will it accept whatever other auth factor I present (a password?) anyways? What's left then?
chayesfss 13y ago
Here's how it works. As a user I want to connect to a web resource, I am redirected to my idp (SecureAuth) where we ask you your name, then I look at your account and ask you to enroll, then I ask you your password. Now before I generate a claim/token or what ever I take your fingerprint so for the next day/30 days/90 days or what ever your fingerprint is checked between your username/password and the strong authentication is transparent to the user. The variables can all be weighted differently and the fingerprints can easily be revoked but it is very cool technology.

MartinCron 13y ago

I also used a similar concept to help us investigate charges of of cheating in an asynchronous online strategy game where sock-puppet collusion would destroy the balance. Having an extremely high probability that two accounts are actually the same browser made it easier for us to warn|block|ban cheaters.