Software can identify peole based solely on the way they use their mouse and keyboard, and it could let us do away with passwords altogether
AS WE sit hunched over our keyboards, it is hard to believe that the way we peck at the keys and swish the cursor around is unique. But several companies believe this could be used to prove our identity, doing away with one of the most annoying aspects of digital life: passwords.
From e-commerce sites to social media profiles, passwords protect all kinds of sensitive information. But recent security breaches show just how vulnerable the system is. Earlier this year, the Heartbleed bug sent people scurrying to change passwords across a huge swathe of the internet. And in May, eBay announced that over 200 million accounts may have been compromised in a security breach.
This has boosted interest in behavioural biometrics, says Uri Rivner of Biocatch, a firm based in Tel Aviv, Israel. Behavioural biometrics is based on the idea that individuals subconsciously use their mouse and keyboard in predictable ways – and that these behaviours can reliably identify them. Examples of these actions include how quickly a user selects buttons that pop up on screen, how long they hover over menus, how fast they move the mouse and whether they scroll using the cursor keys, the scroll bar or the mouse wheel. Not all of these need to be used, though.
"We don't need to find behaviours unique to each person on the planet," says Neil Costigan, CEO of Behaviosec in Luleå, Sweden. "We just need enough of a spread of behaviours to verify that someone is who they say they are. We look at the behaviour to see if it matches that person's previous behaviour."
Plenty of companies are already beginning to implement this technology. Biocatch ran successful trials on the networks of two different banks, which it announced on 17 June had helped it to raise $10 million in venture capital funding. In the US, IBM is starting to deploy the technique in online security software it sells to banks. And Behaviosec has been funded by the Pentagon's research arm, DARPA, to adapt its desktop behavioural biometrics systems to tablets and smartphones.
IBM's system monitors behaviour only after a person has logged in using their password. This can prevent a fraudster making transactions, pretending to be an authenticated user who has, for example, gone to make coffee without logging out. When behaviours are detected that are out of character, the software will ask them to log in again with some extra security questions.
Biocatch aims to replace passwords entirely, although at the moment its software is also only used after logging in. The system is more active than IBM's, presenting people with what it calls subconscious "challenges" that garner distinctive responses. For instance, the software makes the cursor disappear for a few seconds and the type of mouse motion people use to recover it – clockwise, anticlockwise, large arc, small arc – is recorded.
Rivner says that by building a model of how individuals respond to these challenges, and then monitoring actions while banking or shopping online, the software can tell within a few keystrokes if the user is the same person who originally logged in. He says this is well on the way to ridding us of the hassle of passwords, PINs, captchas and other login methods.
Similar advances are on the way with mobile technology. Touch behaviours like finger pressure, swipe speed, angles of swipe, gyroscope and accelerometer readings can all be harnessed to authenticate a user, says Costigan. "The smartphone has an amazing array of inputs for behaviour recognition."
This article appeared in print under the headline "To log in, press any keys"
Face facts
There are better ways to log in to your computer or mobile device than annoying, forgettable passwords, and plenty of them.
For one thing, you could use your face: some Android smartphones have simple face-recognition that spots your mug to unlock your phone. Your familiarity with other people's faces can work too. This week, a team at the University of York, UK, reached 97.5 per cent accuracy using a login system that presents users with grids of faces and asks them to pick the ones they know. A similar technique is used in apps like Passfaces and Faceguard. "As well as being extremely durable, familiarity is very hard to fake," says team member Rob Jenkins.
- Subscribe to New Scientist and you'll get:
- New Scientist magazine delivered every week
- Unlimited access to all New Scientist online content -
a benefit only available to subscribers - Great savings from the normal price
- Subscribe now!
If you would like to reuse any content from New Scientist, either in print or online, please contact the syndication department first for permission. New Scientist does not own rights to photos, but there are a variety of licensing options available for use of articles and graphics we own the copyright to.
