Behavioral Profiling: The password you can't change

https://paul.reviews/behavioral-profiling-the-password-you-cant-change/

by walterbell • 11 years ago

191 96 11 years ago

Please stop. You're getting your panopticon all mixed up in my internet.

JohnyLy• 11 years ago

It sounds great and much more protective than passwords. You can't copy/imitate behaviors. However, I am wondering if the system still works if you are tired or sick. Your behavior might change in this case and therefore the system would not recognise you.

Cshelton• 11 years ago

That's the first thing I thought of, tired or sick. Or how many times I've used one hand to type in my password because I had a drink or food in my other.

How would mobile work with this? Sometimes I use both fingers, sometimes just my thumb on one hand. Would it just create multiple behavior profiles for me that are accepted?

In combination of the right password and the behavior match, it seems like this would actually be pretty strong. I'm looking forward to trying to break it tomorrow with a friend.

typis710• 11 years ago

I think you misunderstood the intention of this feature. The goal is to identify and/or profile users that themselves use just a regular log-in. This can be then used to improve targeted marketing, selling that information to third-parties for example.

Note how the article mentions that the gender can be determined after a few keystrokes, even though the user never entered that specific information. This is certainly not the only metric that can be identified. The point of the article is to develop a solution to prevent leakage of private/personal information.

learnstats23• 11 years ago

Note how the article mentions that the gender can be determined after a few keystrokes, even though the user never entered that specific information.

Research got median 88% accuracy testing subsets of 98 males and 35 females.

Note that I got 74% accuracy on that data set by guessing male, male, male, male, male...

noir_lord• 11 years ago

And keyboards, different devices I.e. laptop vs desktop.

You could use it as an indicator and trigger a warning email.

golergka• 11 years ago

Would that work if the user changed keyboards? I used Apple keyboards of various types for the last five years, and recently bought myself a new gaming pc with a gaming keyboard — and while WASD feel is great, typing is a nightmare, and I feel that my WPM count is three times smaller than on keyboards I'm used to.

liw2• 11 years ago

If you can't change it, it's a username, not a password.

tom-lord3• 11 years ago

There are plenty of sites that allow you to change your username!

dhmholley• 11 years ago

(Though unfortunately not HN)

jessaustin3• 11 years ago

The observation that some usernames are changeable, doesn't contradict the claim that passwords must be changeable, nor does it contradict the claim that usernames need not be changeable.

Taek2• 11 years ago

I wonder if it makes sense to disable some of that information in JavaScript. You couldn't disable it for js videogames, but I see no reason for most websites to be able to track your behavioral profile.

The problem is that behavioral profiling will get better. How long you stay on a page, which links you prefer, and potentially a lot of the metrics that companies routinely use to A/B test their page would also reveal your behavioral profile.

It's a similar problem to rhetorical analysis. It's difficult to publish a paper anonymously if you have other publications because the rhetoric is likely to have your fingerprint plastered all over it.

Privacy is rapidly eroding and it's not clear the trend can be reversed.

InclinedPlane• 11 years ago

These sorts of techniques have widespread applicability. Who needs facial recognition when you have kinematic behavioral analysis? Just imagine the trove of data you could pull from existing information sources if you had unlimited analytical time and computational power? As computing power becomes even cheaper and various analytical techniques become better our "effective privacy" window in our partially-anonymous society will grow ever smaller.

TeMPOraL• 11 years ago

That's why I'm still entertaining the thought that we may be a "privacy vs. progress of mankind, chose one" type of situation. "These sorts of techniques" are the first scraches on the Great Web of Causality. I don't see a way to prevent it short of banning general-purpose computation. But are we going to deny ourselves all the advances in medicine, disaster relief, energy efficiency, etc. to protect ourselves from some future governments that may get funny in their heads? Maybe it's time to embrace that our "effective privacy" was only a temporary state of affairs, a historical abberation of the industrial age. I don't know if this is a good idea or not, but I suspect we'll learn to live with it and proper social customs will develop around snooping on your neighbours.

By the way, it's funny how often the discussions turn into "we need to stop technology X because evil advertisers will use it to do their evil things". It's not technology X that is the problem, it's evil advertisers that are assholes, and we need to find the way to get rid of the latter, not the former.

cosmolev• 11 years ago

Will it really work on a large user base?

There are a lot of approaches around (big data, profiling, machine learning, ...) based on the assumption that people usually behave in the same way. And they really do.

This thing is quite the contrary.

interfixus3• 11 years ago

We already know that places like Facebook monitor our every keystroke and store them for posterity. Yes, they hang on, also to the text you regretted, backspaced, and never published. It would seem utterly unprofessional, and potentially detrimental to shareholder interest, for them to not also keep track of timings and typing rhythms. Which makes me wonder how much mood analysis, lie detection, and other psychometrics they really have collected on us all over the years, given the right kinds of algorithms to run the lot through.

jkot• 11 years ago

Google Doc does that as well

JoshuaRedmond• 11 years ago

That was actually my first thought. There was the story last year about replaying the typing of a Google Doc[1], and as it stores the time between keystrokes it struck me that an attacker could feed document you've written into an extension like this but in reverse, thus typing with exactly the same signature as yourself (at least in respect to the gap time).

[1] http://features.jsomers.net/how-i-reverse-engineered-google-...

bluefinity• 11 years ago

That would be... disturbing. Fortunately it's not true, as you can see for yourself with the chrome developer tools.

creshal• 11 years ago

On the other hand, Windows 10 collects these data by default, according to their privacy statements.

interfixus3• 11 years ago

It was true at one stage, according to official acknowledgement form Facebook. There's a discussion somewhere here on Hacker News. Can't find the link right now.

746F7475• 11 years ago

If this doesn't get implemented into browsers as a default option or usage of extension doesn't get popular people using this are going to be easy to identify. It's like someone using just normal http and suddenly using https and Tor. You are going to stick out.

typis710• 11 years ago

I wonder how popular are NoScript/AdBlock percentage wise these days?

why-el2• 11 years ago

I tried NoScript for a bit. Obviously most social networks stopped working, but I liked how NYT became free again (since they track you by a cookie) and obviously HN remained solid. Essentially NoScript just means no online socializing, which I think I might grow to become ok with.

Udo2• 11 years ago

What a huge nightmare waiting to happen. Sites already give me shit for changing my location, making me jump through additional hoops because my browser signature changed, refusing to let me purchase something because I don't access them from my home country. The last thing I need is a behavioral profiler that insists it has determined I'm not me and there is nothing I can do to prove it wrong.

blowski• 11 years ago

True - I was thinking "what happens if I burn my finger while cooking?" It does seem like a solution looking for a problem.

pandler• 11 years ago

Or, what if I've had a few beers and my typing is getting sloppier.

jmnicolas• 11 years ago

You mean : "It does seem like a solution cooking for a problem." ? ;-)

palmer_eldritch• 11 years ago

Or, what if I learn to touch type?

troels2• 11 years ago

Presumably, such a system would escalate to a more heavy weight authentication. We're already seeing something similar with sites trying to figure out if you're a bot or not. For example, if you make edits on stackoverflow, the site might decide to challenge you with a captcha from time to time.

Udo2• 11 years ago

The article doesn't make it sound like this would be a first line of defense, in fact the author seems quite adamant about its infallibility, but even if such algorithms would be used conservatively it would still be a huge hassle. Imagine every major website nudging you with a popup every once in a while: "we don't like the way you're typing, please use our code generator mobile app to prove it's still you".

I allege that this would have a huge number of false positives for no discernible reason to begin with, but on top of that: I might be on a different keyboard, using a different mouse, using a track pad, might be in bed lazily trying to log in with my laptop, might be injured, might be distracted, I might be in another country using an unfamiliar keyboard layout, a different screen size, the list goes on...

indymike• 11 years ago

One of the banks I use had a keyboard profiling feature on their login page for three or four years and discontinued it in the last year or so. The reason: customers hated it because it did not work well enough (i.e. it would reject your login 3-4 times before accepting it).

bitL• 11 years ago

Get your own personal assistant robot, Intel Jimmy-style, switch into a personality profile of your choice (I am in an Amazon mood today, next I want to shop on eBay etc.) and voilà! Pas de problème!

Flammy• 11 years ago

I'm curious how much the ergonomics of your computer play into this...

amelius• 11 years ago

Also, when logging into my bank account and I'm anxious to see if that big deposit has been made, my behavior might be different than when checking at the end of the month if there's anything left.

mpatachi• 11 years ago

I might not get everything right, but aren't they proposing "kind of" a keylogger as a security solution? Even the idea of using a technology for which others build products to fight against seems a bit strange.

Now, admitting that everyone will use it in good faith, I'd like the fact that, by itself, it does not add another thing you need to do as a user to authenticate. But, as Paul said in his article, I only see it used as a trigger for other security measures.

rjaco31• 11 years ago

I don't see why you find the idea that strange, an anti-virus is already running on your computer, hooking all your programs, and sniffing on your connections. Offense & defense have always used virtually the same techniques.

coldcode• 11 years ago

I wonder how effective this would be on mobile keyboard. I can type fairly well on a desktop keyboard but on mobile it's more complex since you can have plugin keyboard enhancers.

bbrazil• 11 years ago

http://blog.dustinkirkland.com/2013/10/fingerprints-are-user... bears repeating. If you can't change it then it doesn't make for a good passwords as there's no revocation.

This sort of thing is useful as a signal when deciding if a user is who they say they are, but it's not sufficient on it's own.

ixwt• 11 years ago

After reading about this post, I was theorizing about using this kind of system in an enterprise system to help with intruder detection.

It would be another thing an intruder would have to bypass, and it could be constructed loosely enough to not interfere with a normal work day. Essentially just a flag, rather than a lock-out if it detects a failure.

I imagine a suite of behavior heuristics would be something of interest to a big enterprise company.

bitbandit• 11 years ago

This means that if I break a finger playing volleyball, I will need to go through extra verification steps to access an app.

kasparsklavins• 11 years ago

My typing speed waries from 70 to 120 words per minute.. Cant imagine this working

kriro• 11 years ago

How is the profiling data supposed to be used theoretically? I hope not as a full login. I'd count it as a "what you are" type of item like a fingerprint and would just only want to use it as a username. I think session expiration could actually be an interesting use case. Instead of/in addition to "session expires after X minutes" you could expire the session after the behavioral delta is big enough. But I'd assume a different login mechanism. Could be good session hijacking protection, especially for applications that require regular interaction anyway.

Love that there's countermeasures already. Well written article, too :)

typis710• 11 years ago

Practically speaking, you will get advertisements, that have a measurably larger chance of you following up on them, i.e. targeted adds.

coob• 11 years ago

Isn't Google's recaptcha already doing this?

http://www.wired.com/2014/12/google-one-click-recaptcha/

Aoyagi2• 11 years ago

Yes. It's annoying, because it taunts me with efforless click once or twice a day while it wastes my time with the annoying image matching for the rest of the day.

typis710• 11 years ago

I blocked the domain. If the site presents me with a re-captcha, I don't even have to think whether to use that site.

annnnd• 11 years ago

Most (if not all) behavioral profiling systems check your mouse movements too. However in my experience, mouse movements do not provide sufficient metadata to accurately identify a user

I would love to know more about this. Online ad networks have access to mouse movement patterns on web pages, but users (usually) don't enter data through keyboard on such pages. And I would expect they already use this mouse movement data to catch fraud... I wonder if it can be used to identify users?

arihant2• 11 years ago

I hope these services have an opt-out. I know, I know, this will get infinitely more accurate at an arbitrary point in the future, and that I won't have complaints then.

But I get screwed constantly while travelling to other countries, getting repeatedly locked out of Gmail. Again, most users won't face these issues. But I don't want to live in a world where if you're not a nominal case, you're screwed.

The people who think passwords are hard will keep getting older and will be washed away. The generation coming in thinks paper is a broken iPad. So exactly, why do we need to solve the problem of passwords, when even slightly savvy users can handle it. Is it so hard to figure out that not too long in future, you can expect all your users to be comfortably savvy?

Also, passwords are deterministic and are a better UI. The Android Lollipop's on-body smart lock, for example, is pure non-deterministic headache. Haven't we gone through this with automatic sliding doors already?

theseatoms• 11 years ago

The people who think passwords are hard will keep getting older and will be washed away.

I wonder if younger generations use more secure passwords. I'd guess that the typical user does not.

Vexs• 11 years ago

Nope. Passwords used by them young folk just fit the requirements, and nothing else. Now, geeky XKCD readers probably use a variant of correcthorsebatterystaple, so we've got that going for us.

TheCowboy• 11 years ago

A temporary way to opt-out of some of these things might be a good thing.

I am on the glass half empty side of if user passwords will improve on a scale required. Even if you get to 90% of users using a good enough password, that still seems too low. For an average user, it is difficult to use a different password AND remember it, and that barrier probably will not change much. Many users still aren't going to start using a password safe.

The article mentions but dismisses multi-factor as degrading the user experience. But I think with the dominance of mobile devices, that providing a simple multi-factor token has become easier than carrying an RSA dongle. I find Google's use of the SMS token to be quite convenient.

arihant2• 11 years ago

I agree on multi-factor point. Recently, some apps even grab the SMS automatically and authenticate. I was surprised early this week, an app actually grabbed my MasterCard Securecode OTP, automatically filled it in and pressed submit. So degrading user experience of OTPs is not very true on mobile.

Moreover, in the mobile dominant world, use of public computers is very less. So typically an authenticated session would last months or years, rather than a few hours. So it is less of an annoyance.

wtbob• 11 years ago

Yet another reason not to enable JavaScript in the browser…

And then there's Rowhammer (http://googleprojectzero.blogspot.com/2015/03/exploiting-dra...).

Htsthbjig• 11 years ago

Well, yes you can change your behavior, and no, this is not a good idea.

We worked in biometrics like 4 years ago or so. It is trivial to defeat this "security mechanism".

We had snake oil people trying to convince us to invest in this(we are a software company), so we made a bet: If we could defeat their marvelous thing on a test they will pay all of our tester team a dinner(and go away and don't bother us again).

It was as easy as creating a prototype trainer. You record a person typing with a webcam. You make some statistics and then in 10 minutes you could train ANYBODY to copy the same behavior signature.

It took us like 2 hours to create the prototype trainer. After testing it we realized the webcam WAS NOT EVEN NEEDED, the microphone is enough.

So we used a single hidden microphone to record the people chosen by the snake oil team and ALL OF US(10 people) were able to defeat the system. Really fun for us, extremely humiliating for the snake oil people.

BTW: This man is proposing a complete keylogger of all your actions in the computer, what could go wrong?

ThomPete2• 11 years ago

Although you are of course right there is something underlying interesting about what could be done to track us in order to build a unique "ghost" of us that can can be used for many purposes beyond logging in.

But given I am not an expert in this field I would like to turn around and perhaps ask you, what is the bigger vision?

Surely biometrics in all sorts of shapes and forms comes with it's own issues and shortcomings.

Isn't the idea to make it good enough not necessarily 100% airtight (although I do understand that the scaleability of technology makes it the requirements many times higher than between people)?

logfromblammo• 11 years ago

This concept was used in _The Dosadi Experiment_, by Frank Herbert. The Dosadis would input all available information on an adversary into a computer, and build a personality model of them. They would then run game scenarios against the model to find the optimal strategies to achieve some desired goal.

If you can assemble an AI copy of someone, you have an almost unbeatable weapon against him. You can make him do things that he thinks are his own ideas, just by adjusting the input parameters.

If you want someone to walk on one side of the street, and you know he avoids panhandlers, you put a fake panhandler on the other side. If you want him to slow down or stop at a certain point on that side of the street, and you know he likes motorcycles, you park a custom chopper there. And while he's gawking, you pick his pocket, or bag his head and shove him into a van, or stab him with a drugged needle, or whatever other spy movie crap you might have in mind.

If you have a detailed enough model to authenticate someone, you may also have a good enough model to impersonate them, or to influence their behavior for your own ends.

therobot24• 11 years ago

Surely biometrics in all sorts of shapes and forms comes with it's own issues and shortcomings.

Indeed. A behavioral biometric like this is probably most similar to gait recognition (identifying someone by they way they walk). It's slightly better than a 'soft biometric' like skin color and gender, but not good enough for any type of large scale deployment. Usually when researchers show this stuff it's more or less for novelty. With that in mind, there really shouldn't be a 'bigger vision' because recognition rates are usually not good enough to merit anything other than an occasional paper.

fweespeech2• 11 years ago

I'm honestly more worried Google or an advertising company would be using this technique than its value as a security mechanism. It'd just be one more chunk of information in the browser fingerprinting process.

Changing your natural, habitual behavior is hard.

The sad part is, this probably would be pretty effective at catching bots due to the fact they likely are largely repetitive and/or skip the mouse move to simply click a location.

n3o59hf• 11 years ago

Isn't Google's new capcha system something similar already? https://www.youtube.com/watch?v=jwslDn3ImM0

Nacraile• 11 years ago

It doesn't even add another factor, really. If I can trick you into revealing your password, I can capture your typing pattern at the same time. Same goes for snooping or compromising other sites' auth DBs. At best this adds a bit of entropy that you don't need to remember, but it's probably not much, and you can't change it...

cmkrnl• 11 years ago

Walk without rhythm/and it won't attract the worm...

vjvj• 11 years ago

Cool tool but kinda ironic that someone built a privacy tool for Chrome only

vinceguidry• 11 years ago

It'll only last until web APIs take over and the new hotness is third-party clients for everything.

Lawtonfogle• 11 years ago

Imagine the behavior profiler learning enough to notice trends and even changes in groups. Imagine if it could identify enough to determine people who had previously been sexually victimized. I wonder how much that type of data could sell for.

My problem with all of this prfiling/bio-metrics is an extension of the problem with retinal scanning. It isn't a question of if it works or not, but of what information other than identity does it leak.

Behavioral Profiling: The password you can't change

Related Stories