Comment Been there, done that (Score 1) 259
New authentication scheme? This technique has been around for awhile--and not just in Morse code. I wrote working code that did this about 7 or 8 years ago. It was only 300 lines of C code. So, having first-hand experience, I am able to address some of the issues brought up here.
Typing patterns can change slightly over time or different keyboards, but some (if not most) of that variation can be accounted for statistically. Every time the user is correctly authenticated, you just add that pattern to the database. This won't handle drastic changes (like a broken hand), but it does pretty well for most cases. My system was originally trained on 10 training runs of typing the user's first name, last name, user name, and password. The login sequence required all of these, so it was a little bit longer than the standard username-password sequence.
Now, you probably can't tell your wife your password and have her log in for you, but the system could still be useful in government systems where per-user traceability is mandatory. The assumption here would be that the recognized failure modes would be acceptable, and sysadmins would be willing to handle them individually.
The system I wrote did not just measure typing speed. It actually looked at the latency patterns between each keystroke. By tweaking the similarity threshold, I could get it so that it would accept most of my attempts, but reject a lot of other people trying to log in as me. I type faster than 100 WPM, so just matching my speed was impossible for most people. I had a friend who was also a fast typist try to impersonate me. It took him a long time, but he was finally able to get in after many tries. His primary problem was typing my user name correctly and fast enough. This was difficult since it's a one-handed finger-twister. My impression after this test was that accomplished typists are consistent enough that there is minimal variation and that the recognition essentially degenerates to a speed measurement (although I don't have quantitative results to prove this). I did not do any testing on poor typists. I would have concerns about whether hunt-and-peckers would be recognized. The system did take into account the user's volatility, but it's possible that the keystroke latencies of poor typists are not normally distributed. This would pose a problem, but it might be ameliorated by using a dynamic threshold based on the users' consistency.
Typing patterns can change slightly over time or different keyboards, but some (if not most) of that variation can be accounted for statistically. Every time the user is correctly authenticated, you just add that pattern to the database. This won't handle drastic changes (like a broken hand), but it does pretty well for most cases. My system was originally trained on 10 training runs of typing the user's first name, last name, user name, and password. The login sequence required all of these, so it was a little bit longer than the standard username-password sequence.
Now, you probably can't tell your wife your password and have her log in for you, but the system could still be useful in government systems where per-user traceability is mandatory. The assumption here would be that the recognized failure modes would be acceptable, and sysadmins would be willing to handle them individually.
The system I wrote did not just measure typing speed. It actually looked at the latency patterns between each keystroke. By tweaking the similarity threshold, I could get it so that it would accept most of my attempts, but reject a lot of other people trying to log in as me. I type faster than 100 WPM, so just matching my speed was impossible for most people. I had a friend who was also a fast typist try to impersonate me. It took him a long time, but he was finally able to get in after many tries. His primary problem was typing my user name correctly and fast enough. This was difficult since it's a one-handed finger-twister. My impression after this test was that accomplished typists are consistent enough that there is minimal variation and that the recognition essentially degenerates to a speed measurement (although I don't have quantitative results to prove this). I did not do any testing on poor typists. I would have concerns about whether hunt-and-peckers would be recognized. The system did take into account the user's volatility, but it's possible that the keystroke latencies of poor typists are not normally distributed. This would pose a problem, but it might be ameliorated by using a dynamic threshold based on the users' consistency.
