5 ms·

Well, yes you can change your behavior, and no, this is not a good idea. We worked in biometrics like 4 years ago or so. It is trivial to defeat this "security

Well, yes you can change your behavior, and no, this is not a good idea. We worked in biometrics like 4 years ago or so. It is trivial to defeat this "security mechanism". We had snake oil people trying to convince us to invest in this(we are a software company), so we made a bet: If we could defeat their marvelous thing on a test they will pay all of our tester team a dinner(and go away and don't bother us again). It was as easy as creating a prototype trainer. You record a person typing with a webcam. You make some statistics and then in 10 minutes you could train ANYBODY to copy the same behavior signature. It took us like 2 hours to create the prototype trainer. After testing it we realized the webcam WAS NOT EVEN NEEDED, the microphone is enough. So we used a single hidden microphone to record the people chosen by the snake oil team and ALL OF US(10 people) were able to defeat the system. Really fun for us, extremely humiliating for the snake oil people. BTW: This man is proposing a complete keylogger of all your actions in the computer, what could go wrong?

fweespeech 11y ago
I'm honestly more worried Google or an advertising company would be using this technique than its value as a security mechanism. It'd just be one more chunk of information in the browser fingerprinting process. Changing your natural, habitual behavior is hard. The sad part is, this probably would be pretty effective at catching bots due to the fact they likely are largely repetitive and/or skip the mouse move to simply click a location.
- n3o59hf 11y ago
  Isn't Google's new capcha system something similar already? https://www.youtube.com/watch?v=jwslDn3ImM0 https://www.youtube.com/watch?v=jwslDn3ImM0
  - fweespeech 11y ago
    Yes, but they could include it on all google products.
    - tg3 11y ago
      they might already.
ThomPete 11y ago
Although you are of course right there is something underlying interesting about what could be done to track us in order to build a unique "ghost" of us that can can be used for many purposes beyond logging in. But given I am not an expert in this field I would like to turn around and perhaps ask you, what is the bigger vision? Surely biometrics in all sorts of shapes and forms comes with it's own issues and shortcomings. Isn't the idea to make it good enough not necessarily 100% airtight (although I do understand that the scaleability of technology makes it the requirements many times higher than between people)?
- logfromblammo 11y ago
  This concept was used in _The Dosadi Experiment_, by Frank Herbert. The Dosadis would input all available information on an adversary into a computer, and build a personality model of them. They would then run game scenarios against the model to find the optimal strategies to achieve some desired goal. If you can assemble an AI copy of someone, you have an almost unbeatable weapon against him. You can make him do things that he thinks are his own ideas, just by adjusting the input parameters. If you want someone to walk on one side of the street, and you know he avoids panhandlers, you put a fake panhandler on the other side. If you want him to slow down or stop at a certain point on that side of the street, and you know he likes motorcycles, you park a custom chopper there. And while he's gawking, you pick his pocket, or bag his head and shove him into a van, or stab him with a drugged needle, or whatever other spy movie crap you might have in mind. If you have a detailed enough model to authenticate someone, you may also have a good enough model to impersonate them, or to influence their behavior for your own ends.
  - ThomPete 11y ago
    Agree, the question I guess is if there is any research into finding a way to make the ghost "part of your dna" in some way so that it's tied to you and you to it? I know this is probably naive sci-fi but I have heard crazier things. I guess at the end of the day it requires that the interfacing is not just digital but also somehow biological/genetic.
  - deleted 11y ago
Nacraile 11y ago
It doesn't even add another factor, really. If I can trick you into revealing your password, I can capture your typing pattern at the same time. Same goes for snooping or compromising other sites' auth DBs. At best this adds a bit of entropy that you don't need to remember, but it's probably not much, and you can't change it...

fweespeech 11y ago

I'm honestly more worried Google or an advertising company would be using this technique than its value as a security mechanism. It'd just be one more chunk of information in the browser fingerprinting process. Changing your natural, habitual behavior is hard. The sad part is, this probably would be pretty effective at catching bots due to the fact they likely are largely repetitive and/or skip the mouse move to simply click a location.

n3o59hf 11y ago
Isn't Google's new capcha system something similar already? https://www.youtube.com/watch?v=jwslDn3ImM0 https://www.youtube.com/watch?v=jwslDn3ImM0
- fweespeech 11y ago
  Yes, but they could include it on all google products.
  - tg3 11y ago
    they might already.

ThomPete 11y ago

Although you are of course right there is something underlying interesting about what could be done to track us in order to build a unique "ghost" of us that can can be used for many purposes beyond logging in. But given I am not an expert in this field I would like to turn around and perhaps ask you, what is the bigger vision? Surely biometrics in all sorts of shapes and forms comes with it's own issues and shortcomings. Isn't the idea to make it good enough not necessarily 100% airtight (although I do understand that the scaleability of technology makes it the requirements many times higher than between people)?

logfromblammo 11y ago
This concept was used in _The Dosadi Experiment_, by Frank Herbert. The Dosadis would input all available information on an adversary into a computer, and build a personality model of them. They would then run game scenarios against the model to find the optimal strategies to achieve some desired goal. If you can assemble an AI copy of someone, you have an almost unbeatable weapon against him. You can make him do things that he thinks are his own ideas, just by adjusting the input parameters. If you want someone to walk on one side of the street, and you know he avoids panhandlers, you put a fake panhandler on the other side. If you want him to slow down or stop at a certain point on that side of the street, and you know he likes motorcycles, you park a custom chopper there. And while he's gawking, you pick his pocket, or bag his head and shove him into a van, or stab him with a drugged needle, or whatever other spy movie crap you might have in mind. If you have a detailed enough model to authenticate someone, you may also have a good enough model to impersonate them, or to influence their behavior for your own ends.
- ThomPete 11y ago
  Agree, the question I guess is if there is any research into finding a way to make the ghost "part of your dna" in some way so that it's tied to you and you to it? I know this is probably naive sci-fi but I have heard crazier things. I guess at the end of the day it requires that the interfacing is not just digital but also somehow biological/genetic.
- deleted 11y ago

Nacraile 11y ago

It doesn't even add another factor, really. If I can trick you into revealing your password, I can capture your typing pattern at the same time. Same goes for snooping or compromising other sites' auth DBs. At best this adds a bit of entropy that you don't need to remember, but it's probably not much, and you can't change it...