Advantages:
- no extra Hardware
- keeps up to date: every new login is saved for your profile
- no password needed
- keyloggers difficult

Disadvantages:
- maybe you shouldnt’ break your arm or hand

Convice yourself:
http://www.psyl...r&Itemid=63

As a marketing proposition it really doesn’t belong in the same league as these technologies, calling it “biometric” is complete nonsense as it creates an impression of being comparably accurate. As a security product it’s an odd duck, depending on a behavioral measure. It doesn’t belong in any of the 3 usual security categories: something you have (like a car key), something you are (like a fingerprint), something you know (like a password).

Perhaps there is a market for it where a cheap (no extra hardware needed) security solution is required where it’s more important to create the appearance that something is being done than to actually improve security. er, possibly in government agencies?

I’ve been pretty outspoken about my love for biometrics in healthcare. In particular I couldn’t imagine my computer without facial recognition, but I’ve also enjoyed playing around with biometric fingerprint readers and proximity rea…

During the World Wars surveillance teams would listen to enemy radio traffic being transmitted using morse code.

The surveillance teams could eventually tell which operator was operating on any specific day based on their timing and technique, they called the method “fisting” (no joke) IIRC.

I used to run a small QA team working on a similar product. We found the tech could work, but only under tightly constrained circumstances. Out of a sample of 5 typists, we’d see a “pair” or two between which it would work reasonably well well, while with others it wouldn’t to one degree or other. Sometimes it would work in both directions (neither A nor B could break each other’s pass). Sometimes only in one direction (A couldn’t break B’s but B could break A’s). Among many, many other problematical behavioral and technical issues which our little QA group was able to come up with, this could be enhanced simply by having B present while A was typing, by listening and attempting to duplicate the pattern. Someone above mentioned the differences between keyboards. Back in the 80’s corporate environments might contain 100’s or 1000’s of identical keyboards, all from the same mainframe manufacturer, all purchased from the same production run, thus eliminating one very significant variable. Today obviously this has radically changed. Again our QA group was easily able to indentify pairs of keyboard types between which it was almost impossible for the tech to work at all, let alone reliably and efficiently.

So, you may take this test under limited circumstances (same computer, same time of day, same frame of mind, with a friend who happens to ‘match’ well, etc) and be impressed. But we found using a statistically valid sample, and under just about any real-world, variables-allowed circumstance, that the technology just doesn’t measure up in terms of acceptable false-positive and false-negative rates.

However, some repeating authentication along the lines of Vidoop with images would probably be better and less cumbersome.

Can’t really see this being used for data security on consumer or corporate websites.

A sure way to loose customers, I’d say.

Any environmental change will influence your typing. I’m quite dyslexic today and keep inserting spaces in wrong places. Will I be able to login tomorrow with my normal typing pattern?

In fact, within weeks of BofA adding their multi-factor authentication the the cute little sitekey, a leading trojan kit already had support for grabbing that (in theory) secret image right off the computer.

Adding to the trojan kit the ability to capture keyboard timing as well as actually keystrokes is a nit.

This is a security speedbump at best.

Obvioulsy one of the advantages of web based services is the ability to access them from any location and any device.

This technology breaks as soon as you change to / from a normal keyboard. Sign up on your desktop and you will fail the biometric test from your iphone / blackberry, or even a sub-notebook like the eeepc.

This technology had a place in the 80s and 90s, but I think mobile technology has made the technique unworkable.