Jonathan Richards
2 for 1 tickets to Singin' In The Rain, this coming Monday. Book now
The speed at which you type may now be used to determine whether you are allowed to view your bank account details or use other online services.
A US company is aiming to reduce the risk of identity theft by introducing ‘bio-security’ to passwords, meaning that users would have to type their user name and password with consistent speed in order to be logged in.
The technology, which measures the time for which keys are held down, as well as the length between strokes, takes advantage of the fact that most computer users evolve a method of typing which is both consistent and idiosyncratic – especially for words used frequently such as a user name and password.
When registering, the user types his or her details nine times so that the software can generate a profile. Future login attempts are measured against the profile which, the company claims, can recognise the same user’s keystrokes with 99 per cent accuracy, using what is known as a “behavioural biometric.”
“In a climate of identity theft and the increasing need for data protection, there’s a need for a more portable and stronger way of authenticating individuals,” Jared Pfost, vice president of security of product strategy at BioPassword, said. "This is a cost-effective solution that doesn’t require any change in the user’s behaviour."
If users type with more vigour – or languor – than usual, additional security questions are posed to allow them to log in in the traditional manner.
When Times Online trialled the program, your correspondent’s unique typing style not only foiled the log-in attempts of two others, but could be replicated with no great concentration on his part. Similarly, he was unable to imitate other typists' strokes, no matter how closely he observed them.
BioPassword, which is based in Washington State, will compete with the key-ring sized devices that banks have taken to issuing which generate numbers at random for customers logging in to provide an additional layer of security.
Security experts were sceptical about the technology, however, saying that it had been around for some time, and that until its success was proven in large surveys, adoption would remain limited.
“What about if you’re trained as typist? Do you type the same way as others who learned the same way?” Paul Vlissidis, technical director at NCC Group, said. “Also, the system would need to be recalibrated every time you changed your password. With a fingerprint, that only happens once.”
Ross Anderson, a computing science expert at Cambridge University, dismissed the technology out of hand: “It’s been around for 20 years, and was tried and failed before. Typing patterns vary,” he said.
The idea of keystroke recognition has been around since the Second World War, when Morse code operators used it ascertain the identity of senders, but the technology was only formally developed in the 1980s.
Windows programs have for a long time captured keystroke information, Mr Pfost, himself a former Microsoft employee, said, but this was the first time it had been commercialised as a security solution.
Biopassword has more then 50 customers – mostly small banks and building societies – in the US, and recently announced it had secured $11 million (£5.5 million) in venture capital funding.
The system costs $34,000 (£17,000) to install, with a subscription of $1.15 (58p) per user per year.
Enjoy screenings of all the classic films you love, plus take advantage of two-for-one tickets
Have you ever dreamed of owning your own racehorse or a beautiful painting?
Enjoy comfort, safety, space and great design. Plus enter our great competition
Times Online's new TV show helps you make the right decisions for your pet
Are you California dreaming? Explore the wonders of the Golden State. Also enter our fantastic competition
Do you have what it takes to be a Times photographer?
Your brain is capable of more than you might think...
Find out to make the most of your money with our wealth management guides
Need help with your property? We have an entire how to guide - buying, selling, letting, moving, to help you
We are seeking entries for the inaugural Sunday Times Best Green Companies Awards
Enjoy some wonderful inspiring wildlife moments
An interactive preview of the brand new For Your Eyes Only exhibition

Love Sudoku? Play our brand new interactive game: with added functionality and daily prizes

Are you irritable when you return from work? Drained of emotion? You could be suffering from boreout
Prepare for some shock and awe, petrol lovers. Despite the greens trying to wipe it out, the car is about to offer us the most exciting year ever
We've trawled the brochures and websites to find this summer’s best holidays for every taste and budget


Get our new mobile internet service.
Text Times to 86626

Overseas contacts and local business information
2007/07
£57,500
South East England
2007/07
£40,995
South East England
2006/06
£41,995
South East England
Great car insurance deals online
£40-55k+benefits+uncapped commission
Morgan Keating
South East
Up to £30,000
GLE
London
£
c£75,000 + executive benefits
Morgan Keating
London and South
Unpaid with travel expenses
Network Rail
Globrix, the property search engine
Visit Times Online Property for homes for sale or rent
Residential development site with planning permission
£1,500,000
Mortgages, bank accounts & money transfers to help you buy abroad
Dinarobin Hotel Golf & Spa 7 nights
From £1830 per person – saving £530.
Walking & multi-activity holidays in Cauterets. Stylish self-catering apartments.
From 350€ for 7 nights.
SAVE 25% on Sandals Luxury Resorts
Great travel insurance deals online
Contact our advertising team for advertising and sponsorship in Times Online, The Times and The Sunday Times. Search globrix.com to buy or rent UK property.
© Copyright 2008 Times Newspapers Ltd.
This service is provided on Times Newspapers' standard Terms and Conditions. Please read our Privacy Policy.To inquire about a licence to reproduce material from Times Online, The Times or The Sunday Times, click here.This website is published by a member of the News International Group. News International Limited, 1 Virginia St, London E98 1XY, is the holding company for the News International group and is registered in England No 81701. VAT number GB 243 8054 69.
I think a hacker in a phishing site may capture time for each typed character and submit it to real site using a tool designed for this.
Julio, SD,
I hope that BioPassword isn't patented. Like many bright ideas, it isn't original. The idea of using keystroke timings as a way of improving the strength of a password is discussed in detail in "Cryptography: An Introduction to Computer Security" By Jennifer Seberry and Josef Pieprzyk (Prentice Hall, 1989) ISBN 0131949861.
Matthew Donald, Melbourne, Australia
I use KeePass for everything and this would prevent me from using it. Give me RSA SecurID over this anyday!
Luke, London, UK
What happens (as has happened to me in the past) if you've had an accident and you are unable to use both hands for a while? After falling off my bike a few years ago my typing speed was (more than) halved for about 2months...
John Mule, London,
Lots of people, including myself, use 'Speed Typing' software for quickly entering repetetive information. How would this new system cope with such software?
Leslie Layton, London, UK
This device would save me a few quid...
Would stop me logging in to my internet poker when I stumble home at 4am after a Friday night session.
Mark, Woking, UK
If you had read the article, you would have noticed that you are required to provide the answer to additional security questions if your typing behaviour doesn't match the one on file.
Andy, Plymouth, UK
While keystroke speed recognition may not be a good technology against other humans, it will surely provide a deterrent to a computer trying randomly to guess passwords in a large number of accounts. Computers are known to enter password guesses much faster than humans.
Kenn, London, UK
I agree with Dan, if one breaks their arm, or a finger this would surely mean you are unable to login.
Also i dont know about anyone else but when I'm tired at the end of the day I tend to type passwords much slower.
Pete, Bucks,
why not invent a mouse button thst reads finger printsts? that should be pretty fool proof
peter codner, devizes, england
What if you break your arm and can only type with one hand, does this mean you will never be able to access your accounts? Just one example of possibly hundreds that make this a ridculous suggestion!
Dan, Nottingham, UK
Sounds like a good idea.
Tom, London, England