We'll admit to having shared a few login credentials amongst friends here and there in our younger days, but it sounds like the party might soon be over: a company called Scout Analytics has developed a way of identifying a user's "typing cadence," and matching it to how a username and password are entered. It only takes 5 login attempts of around 12 characters for Scout to nab your cadence, and although 1 in 20,000 people will share the same cadence, combining the data with browser info and IP addresses makes it accurate enough for general usage. No word on what sites are using this technique, but we won't be surprised if it starts popping up rapidly -- and sniffing typing cadences becomes the next great malware scourge.
P.S.- Yes, we just wanted to run the picture of the
keyboard pants again. Seriously, can someone please hook us up with those?
posted February 20th 2010 1:57AM
Ctrl-Alt-Balls
Disabled are gonna have fun with "sticky" keys!
@(Unverified)
Guess which is the "F" key.
Who wears pants when on the computer>
those aren't pants...
@yulebellow
then... If their not pants, what are they then?
gasp*
@Spiky haired boy
Yulebellow may be from the UK where our "pants" are their "trousers", and their "pants" are our "underwear". Savvy?
@Yoshi Or he may be referring to the fact that they appear to be cut off at the knee.
@tegwas
Hmm... that seems more obvious. You win.
@Yoshi
Those are cutoff sweat pants. The fly is badly stitched.
He's that much of a nerd that the pink on his pants makes him get a chubby
..That thing is pointing to right...
Am I right?
ummmm TSA would be all over that...
You know, I was going to make a comment about trying to lock me out and how it wouldn't work.
Then I put my glasses on and realized that it was a dude...
Too bad that my typing is different on a keyboard compared to a touchscreen.
@alexz Not to mention different keyboards. I type differently on my laptop vs my, well, other laptop; and differently still on a regular keyboard. I don't see this working out so great.
@wellsley Also, sometimes I don't type with two hands on my laptop, for instance if I'm checking into my bank account before going to bed from my laptop, I might type with one hand to avoid having to roll into a position where I use two hands. Also, drinking coffee with 1 hand and typing with the other...
@alexz
These login systems also take device forensics into account as well, so it can recognize whether you're logging in from your desktop, laptop, iPhone, etc. If the typing cadence were kept track of with a device in would just be one more useful piece of trying to determine the likelihood of fraud.
what if you were drunk/incapacitated, how would that change your cadence?
@aesop
"What is Crtl-Alt-Balls?".
I've actually been varying my typing cadence for years when entering passwords. I don't really know why, I just did. Paranoia I guess. Whats this thing gonna think when I never type my password the same way twice?
Keyboard on your pants, keyboard on your pants, looking like a fool with your keyboard on your pants!!!!
@Virus Cannon
WIN!!
@Virus Cannon
I believe the cadence of your rhyme was perfect. Login successful.
Yee-Ah keyboard pants.
storing that usb cable has got to hurt
Totally saw this on Numb3ers. They caught the bad guy from an audio recording of his typing.
@Sarig
A UC Berkley student did the audio password retrieval thing back in 2005.
http://it.slashdot.org/article.pl?sid=05/09/13/1644259
I dont get it. What is "typing cadences"??
@KGB put briefly, it's the rhythm of you typing (cadence means rhythm, basically). Due to the way everyone learns typing and stuff, most people have a fairly unique rhythm to what they type (and more so for login/passwords where the typing is even more rote muscle memory than anything else)
How lazy can the society be?
I've coded this for a class before. Took about a week. Uses markov models to train a pattern of probabilities of how long you spend on any given key. When ever you enter your password it calculates the probability that the trained model could generate that particular output or cadence and makes sure its within a certain tolerance.
Pattern recognition using markov models is actually the most direct application of upper level math I've ever used.
@Vile Offspring
congratulations,
here's a cookie...
*passes a cookie*
Yep, this concept has been around a good while. I hope Scout Analytics is paying royalties to all the patent holders ;-)
What about those who use password manger (like Keepass)?
what about using different keyboards (laptop and desktop for example)... for sure you will get different "Cadence" pattern. what about your "mood" .. my typing speed and pattern depend in my mood (i type much slower if i am relaxing and use my laptop, while much faster using my office desktop).
@Ahmed Alzayani
I'd be concerned about that a bit. For example, sometimes I type my passwords *very* slowly and one-handed when my dog decides she wants to sit on my lap. If websites needed me to match my usual cadence when typing in the password, I would have to always type the same way.
@Ahmed Alzayani
I agree. I use 1password on my Mac's so I can use secure passwords unique to each site I visit. I only type usernames and passwords when it doesn't work. I find the technology an interesting exercise that will fall flat on its face. There is limited benefit, lots of potential problems (different keyboards, different moods, different situations requiring one-finger salutes) and it seems this will simply lock the right people out, and the wrong people will find a way to circumvent or reproduce the cadence detection.
Interesting and destined to fall into disuse.
@Ryan P "For example, sometimes I type my passwords *very* slowly and one-handed when my dog decides she wants to sit on my lap."
Just don't try letting your dog sit on your lap when you are wearing those keyboard pants. She'll really mess up your cadence then!
So, if I am drunk and try to login from another IP this will not let me in? As if todays password rules are not frustrating enough.
"You password should contain numbers and special symbols, _AND_ have recognizable cadence with at least two pauses longer than one second"
@suncho Then it's a feature and instead of saying, "Typing cadence rejected," it should say, "Don't drink and post."
CadenceBob Keyboard Pants.
Every time I see those keyboard pants I think of Alex Jacobson from Deus Ex. He has keyboard pants pretty much like those. If you play that game (recommended) then pay attention to his pants when you encounter him. He's got keyboard pants.
This is gonna be one of those concepts that will be adopted by idiot corporations far and wide, which they'll waste millions implementing and millions more getting rid of when the light bulb finally comes on.
As far as I know this is already in the process of being implemented by our Real Estate MLS (Multiple Listing Service) when agents try and log in. It's being used to replace the existing fobs that agents have to carry.
More info here: http://www.clareitysecurity.com/solutions-intelligence.cfm
Ok I'm confused what is "Cadence" ?
@Amnak
Basically, it's the timing of your key presses.
@Amnak cadence is essentially rhythm. In this case, it's the rhythm of how you type and how long you press certain keys, how long it takes you to pause in between key press, etc.
"Yeah, sorry I never wrote you back last week. I've not been too healthy and gained some weight; needless to say, I couldn't fit into my keyboard"
Anyone else change cadence depending on the keyboard they're using?
Reminiscent of the unique "fist" of morse code/radio/telegraph whatever operators in WWII, as referenced in a section of Neal Stephenson's Cryptonomicon.