2
$\begingroup$

Hello thank you for taking time looking at this question. Is it possible to determine the keystroke patterns for a certain user?

My idea is that, when the user enters their username & password it must contain a specific keystroke pattern that when analyzed it could probably predict the actual user and able to differentiate other user that might know the exact username and password from hacking or entering the account.

$\endgroup$
  • 4
    $\begingroup$ It's not unknown: en.wikipedia.org/wiki/Keystroke_dynamics $\endgroup$ – ratchet freak Apr 22 '16 at 13:14
  • 1
    $\begingroup$ Coursera does something like this. $\endgroup$ – Raphael Apr 22 '16 at 13:31
  • $\begingroup$ I think this is offtopic for this site. Community votes, please! $\endgroup$ – Raphael Apr 22 '16 at 13:31
  • 1
    $\begingroup$ @EvilJS , Raphael: I don't see why this would be off-topic. Information security is a field of computer science and this question is about applied science. $\endgroup$ – Gilles Apr 24 '16 at 22:43
  • $\begingroup$ @Gilles I have seen similar question which get me thinking is it really CS specific or rather should be asked in Information Security. This is multifield question which I found to be more connected with statistics or security, even behavioural analysis (like in automation of repeating tasks) , but with your answer and reasoning I am convinced to retract my previous thinking. $\endgroup$ – Evil Apr 24 '16 at 23:05
2
$\begingroup$

Keystroke dynamics is indeed a form of biometric recognition that has been studied for a long time. It was already known in the telegraph era: skilled operators could recognize each other's “fist”, similar to recognizing someone's handwriting.

As far as I know, this is not precise enough to authenticate someone. A 2005 study by Araújo et al. results in a 96.34% success rate (3.66% false acceptance) in a controlled experiment, for an imposter, for typing the same user-chosen string 10 times (see §IV.B). The false acceptance rate for a hard-to-type password is likely to be worse. It can be used as a second authentication factor, but as an authentication factor, it's pretty weak.

These days, a lot of authentication is performed remotely, with the typing device under control of the unauthenticated user, who may be the attacker. This means that keystroke dynamics is not reliable in this setting.

Keystroke dynamic is sometimes used, not as a primary authentication factor, but to raise alerts when an account might have been compromised. On its own, it has poor signal, since a user with unusual typing patterns may be wounded, tired, using an unfamiliar keyboard, etc. It can be useful in combination with other factors however.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.