Is a secure password all in the typing?
- By Laura Williams
- May 24, 2011
At some point, everyone finds out that it's not just what you say, it's how you say it. The same thing could apply to secure passwords.
A text password – no matter how many times you change it or how many illogical symbols you incorporate into it – is always going have some inherent weaknesses. It can be stolen via keystroke software or broken into by password-recovery programs, and it can fall into the wrong hands if written down or shared with a co-worker.
All of this drives IT managers crazy, and fed the movement toward two-factor authentication in logical access control. A group of researchers at the American University in Beirut have come up with an unusual biometric that could be used as for that second factor: your typing pattern.
That’s right. The process, called key-pattern analysis, records timing with which a user types in his password and then compares that template to the timing every person uses when trying to gain access to the digital asset. Upon enrollment, a user has to type the password in several times, to allow for all the variations possible.
The field of key-pattern analysis has actually been around for a few decades, but this new research advances it into the realm of the useable. Previous researchers had failed to take into account the fact that quick typists sometimes press more than one key at a time. This effort at producing an effective key-pattern analysis authenticator looked at the length of time for which a user presses the key, which the researchers say gives a better – and more robust – picture of typing patterns.
One of the study’s authors, Ravel Jabbour, points out that, as key-pattern analysis doesn’t require any extra equipment, it is much less costly than solutions such as card readers, which would be required at every work station. And, Jabbour said, key-pattern analysis programs should work almost as well as sophisticated biometrics, such as iris or fingerprint scans.
“If the profile-building phase is conducted with care, there should be no real problem with key-pattern analysis,” he said.