Jonathan Richards
Enter our Snapshots of Summer photography competition
The speed at which you type may now be used to determine whether you are allowed to view your bank account details or use other online services.
A US company is aiming to reduce the risk of identity theft by introducing ‘bio-security’ to passwords, meaning that users would have to type their user name and password with consistent speed in order to be logged in.
The technology, which measures the time for which keys are held down, as well as the length between strokes, takes advantage of the fact that most computer users evolve a method of typing which is both consistent and idiosyncratic – especially for words used frequently such as a user name and password.
When registering, the user types his or her details nine times so that the software can generate a profile. Future login attempts are measured against the profile which, the company claims, can recognise the same user’s keystrokes with 99 per cent accuracy, using what is known as a “behavioural biometric.”
“In a climate of identity theft and the increasing need for data protection, there’s a need for a more portable and stronger way of authenticating individuals,” Jared Pfost, vice president of security of product strategy at BioPassword, said. "This is a cost-effective solution that doesn’t require any change in the user’s behaviour."
If users type with more vigour – or languor – than usual, additional security questions are posed to allow them to log in in the traditional manner.
When Times Online trialled the program, your correspondent’s unique typing style not only foiled the log-in attempts of two others, but could be replicated with no great concentration on his part. Similarly, he was unable to imitate other typists' strokes, no matter how closely he observed them.
BioPassword, which is based in Washington State, will compete with the key-ring sized devices that banks have taken to issuing which generate numbers at random for customers logging in to provide an additional layer of security.
Security experts were sceptical about the technology, however, saying that it had been around for some time, and that until its success was proven in large surveys, adoption would remain limited.
“What about if you’re trained as typist? Do you type the same way as others who learned the same way?” Paul Vlissidis, technical director at NCC Group, said. “Also, the system would need to be recalibrated every time you changed your password. With a fingerprint, that only happens once.”
Ross Anderson, a computing science expert at Cambridge University, dismissed the technology out of hand: “It’s been around for 20 years, and was tried and failed before. Typing patterns vary,” he said.
The idea of keystroke recognition has been around since the Second World War, when Morse code operators used it ascertain the identity of senders, but the technology was only formally developed in the 1980s.
Windows programs have for a long time captured keystroke information, Mr Pfost, himself a former Microsoft employee, said, but this was the first time it had been commercialised as a security solution.
Biopassword has more then 50 customers – mostly small banks and building societies – in the US, and recently announced it had secured $11 million (£5.5 million) in venture capital funding.
The system costs $34,000 (£17,000) to install, with a subscription of $1.15 (58p) per user per year.
Win a luxury weekend to Newcastle and its neighbour Gateshead, find out more here
Risk, resilience and embracing new technology
Industry sectors news at a glance. Interactive heatmap, video and podcast
Discover the collective power of smart thinking. Submit a solution and be in with a chance to win a Flip MinoHD Camcorder
The inside track on current trends in the charity, not for profit and social enterprise sectors
Everything the Business Traveller needs to know to make a better trip
Make the most of the summer and enter our fabulous photographic competition, you could win a £5000 holiday
Corsica is an island of beauty and contrast, an ideal holiday destination
Enjoy further reading from Travel to Fashion, Business to Sport, discover more
Shortcuts to help you find sections and articles
The clever way to lease a new car is with Car leasing made simple™
2009
42,945
2008
71,450
Car Insurance
Not Specified
MI6
UK-based
£60,000
The Environment Agency
Bristol
Up to £90K
Boots
Midlands
OTE £85k
Credit Protection Association
Nationwide Opportunities
Completely London
Luxury Condo's in Manhattan with NYC views
The best new homes in Wimbledon?
Nationwide
Save up to £1,000 per couple with Elite Vacations at the five-star Constance Lemuria Resort
and do the British Isles this Summer.
Save up to 60% with Oxford Hotels and Inns
Try our inspiring luxury holidays to the Indian Subcontinent and South East Asia.
Great offers available
8 fabulous Canadian cities ...you won’t find cheaper
Contact our advertising team for advertising and sponsorship in Times Online, The Times and The Sunday Times, or place your advertisement.
Times Online Services: Dating | Jobs | Property Search | Used Cars | Holidays | Births, Marriages, Deaths | Subscriptions | E-paper
News International associated websites: Globrix Property Search | Property Finder | Milkround
Copyright 2009 Times Newspapers Ltd.
This service is provided on Times Newspapers' standard Terms and Conditions. Please read our Privacy Policy.To inquire about a licence to reproduce material from Times Online, The Times or The Sunday Times, click here.This website is published by a member of the News International Group. News International Limited, 1 Virginia St, London E98 1XY, is the holding company for the News International group and is registered in England No 81701. VAT number GB 243 8054 69.
I think a hacker in a phishing site may capture time for each typed character and submit it to real site using a tool designed for this.
Julio, SD,
I hope that BioPassword isn't patented. Like many bright ideas, it isn't original. The idea of using keystroke timings as a way of improving the strength of a password is discussed in detail in "Cryptography: An Introduction to Computer Security" By Jennifer Seberry and Josef Pieprzyk (Prentice Hall, 1989) ISBN 0131949861.
Matthew Donald, Melbourne, Australia
I use KeePass for everything and this would prevent me from using it. Give me RSA SecurID over this anyday!
Luke, London, UK
What happens (as has happened to me in the past) if you've had an accident and you are unable to use both hands for a while? After falling off my bike a few years ago my typing speed was (more than) halved for about 2months...
John Mule, London,
Lots of people, including myself, use 'Speed Typing' software for quickly entering repetetive information. How would this new system cope with such software?
Leslie Layton, London, UK
This device would save me a few quid...
Would stop me logging in to my internet poker when I stumble home at 4am after a Friday night session.
Mark, Woking, UK
If you had read the article, you would have noticed that you are required to provide the answer to additional security questions if your typing behaviour doesn't match the one on file.
Andy, Plymouth, UK
While keystroke speed recognition may not be a good technology against other humans, it will surely provide a deterrent to a computer trying randomly to guess passwords in a large number of accounts. Computers are known to enter password guesses much faster than humans.
Kenn, London, UK
I agree with Dan, if one breaks their arm, or a finger this would surely mean you are unable to login.
Also i dont know about anyone else but when I'm tired at the end of the day I tend to type passwords much slower.
Pete, Bucks,
why not invent a mouse button thst reads finger printsts? that should be pretty fool proof
peter codner, devizes, england
What if you break your arm and can only type with one hand, does this mean you will never be able to access your accounts? Just one example of possibly hundreds that make this a ridculous suggestion!
Dan, Nottingham, UK
Sounds like a good idea.
Tom, London, England