Behavioral Profiling: The password you can't change (2015)

https://paul.reviews/behavioral-profiling-the-password-you-cant-change/

by zdw • 5 years ago

38 10 5 years ago

paul.reviews

kwhitefoot2• 5 years ago

If you can't change it or revoke it then it is an identity not a password.

taubek• 5 years ago

The problem that I see is changes that can occur over time, e.g. getting older, consequences of some illnes, etc.

Is the "profile" updated or is it the one from the incialzation phase?

sokoloff• 5 years ago

Identity isn’t in opposition to password IMO. (Username might be closer to opposing password.)

The major point of a password is authentication (that the user logging in as username Foo is actually the user they claim to be). If there’s something that you can’t change or revoke, but no one else can imitate it, I agree it’s identity, but seemingly in the good sense of that phrase (as in my family can identify me in both the naming sense, “I am @sokoloff”, and verify the authenticity of my claim “Yup, I confirm that is @sokoloff”).

kwhitefoot2• 4 years ago

That means that I can have only one persona. I don't want the account I have on HN linked with accounts I have elsewhere, the consequences could be uncomfortable.

I want to use different passwords for different accounts and I don't want the password to contain enough information to identify me.

Falkon1313• 4 years ago

If you can't change it or revoke it, then it should not be used for positive security or for identity or authentication. It's the same as if it could change without any intention on your part.

That holds with biometrics too. If I have a new wart on my finger, or maybe a cut or a burn or something, can I still login with my fingerprint? If I'm logging in from a device without a camera, or in a dark place, can I still login with the facial recognition?

If I'm under a lot of stress and typing on a bubble keyboard or perhaps a touchscreen, instead of my usual buckling-spring mechanical keyboard in a relaxed setting, will your measurements of typing speed still allow me to login? What if I use a password manager that autotypes the username and password?

Any addition like that is another potential point of failure. And if it prevents legitimate use, then it's a bug.

However, it does have a place in flagging potentially suspicious activity for review. Banks, at least mine, do a great job of flagging and alerting on suspicious transactions. They've been doing that for many years. Those automated calls that say "Call back at the number printed on your card and press 1 if you authorized all four of the following transactions or 2 if you did not." have a really good success rate in my personal experience. But that doesn't prevent me from buying something or from logging in.

Behavioral profiles are useful, but not appropriate for passwords or identities.

SuoDuanDao• 5 years ago

I came across the term 'cyber phrenology' around the time this was written - seems like a reference to much the same methodology in a different context.

divan• 4 years ago

The coolest thing I've seen in this space is Hristo Bojinov's work on implicit learning. Meaning the password is planted into user's brain without them conciously knowing it so they can't be coerced to reveal it.

Not sure if it got any further traction, though.

Here is the paper from USENIX Security 2012:

Neuroscience Meets Cryptography: Designing Crypto Primitives Secure Against Rubber Hose Attacks http://bojinov.org/pdfs/usenixsec2012-rubberhose.pdf

SilasX• 4 years ago

Related self promotion: my April Fool’s joke that Google will abandon credentials and just do all authentication by your behavior:

http://blog.tyrannyofthemouse.com/2021/04/leaked-google-init...

pfp• 4 years ago

Why haven't browsers added built-in protections against this (or have they)?

Exposing this timing data to arbitrary JS code via the DOM was a horrible oversight in the first place. I doubt any websites apart from interactive games actually need to time keystrokes. For those that do, an opt-in permission (like the camera/mic ones) would work.

mrkramer• 4 years ago

Behavioural analytics don't take into account your mental state. For example when I'm tired and depressed I don't type the same when I'm rested and happy. But general model could somewhat work.

Behavioral Profiling: The password you can't change (2015)

Related Stories