New Update TypingDNA for Chrome - Verifies your Identity based on Typing

[CyberTech]

TypingDNA launches Chrome extension that verifies your identity based on typing

TypingDNA has a new approach to verifying your identity based on how you type.

The startup, which is part of the current class at Techstars NYC, is pitching this as an alternative to two-factor authentication — namely, the security feature that sends unique codes to a separate device (usually your phone) to make sure someone else isn’t logging in with your password.

The problem with two factor? TypingDNA Raul Popa put it simply: “It’s a bad user experience … Nobody wants to use a different device.” (I know that TechCrunch writers have had two-factor issues of their own, like when they’re trying to log in on an airplane and can’t connect their phone.)

So TypingDNA allows users to verify their identity without having to whip out their phone. Instead, they just enter their name and password into a window, then TypingDNA will analyze their typing and confirm that it’s really them.

The startup’s business model revolves around working with partners to incorporate the technology, but it’s also launching a free Chrome extension that works as an alternative to two-factor authentication on a wide range of services, including Amazon Web Services, Coinbase and Gmail.

Popa said TypingDNA measures two key aspects of your typing: How long it takes you to reach a key and how long you keep the key pressed down. Apparently these patterns are unique; Popa showed me that the system could tell the difference between his typing and mine, and you can test it out for yourself on the TypingDNA website.

He also said that the company can adjust the strictness of the system, getting the rate of false positives as low as 0.1 percent. In the case of the Chrome authenticator, Popa said, “We minimize the false acceptance rate” — so you might get rejected if you’re typing in an unusual position, or if there’s some other reason you’re typing slower or faster than usual. But in that case, the authenticator will just ask you to try again.



And again, you can use the Chrome extension on a variety of sites. Most two-factor options allow to confirm confirm a device using a QR code, which TypingDNA can grab. The two-factor codes are then sent to the TypingDNA extension (the codes are stored locally on your computer, not the company’s servers), and they’re revealed once you’ve verified your identity with the aforementioned typing.

You can visit TypingDNA to learn more and download the extension.

Source: TypingDNA launches Chrome extension that verifies your identity based on typing​

 

[ForgottenSeer 58943]

Now you get an idea about what the big guys have to identify you based on even a few typed words.

I remember about 10 years ago some researchers invented a way to determine who typed something in comments or on a forum with 95% accuracy. Typology.

This is actually highly accurate based on just a couple of things typed. However I am skeptical they aren't using other methods to background authenticate other than just typing, like some browser ID, MAC, etc..

 

[Ink]

Another read: The Chrome extension that knows it’s you by the way you type

According to the company, typing patterns allow their machine-learning algorithm to generate a 320-feature vector based on noticing the time it takes someone to move between 44 commonly-used characters, combined with the length of time each key is depressed.

Support for touch-screen devices or on-screen keyboards?

Once enrolled, the way a person types their username and password when logging in to a site is compared to previous recordings made by the user.

If the patterns match, TypingDNA’s servers return an encryption key that is used to unlock local keys held for each service the extension is being used with, allowing the user to proceed to conventional multi-factor authentication.

What if you let your browser or password manager do all the form-filling and sensitive data-entry?

This stage generates a standard one-time authentication code inside the browser, taking over that task from smartphone apps such as Google Authenticator.

It’s like enhanced multi-factor authentication – all the advantages of two-factor authentication (2FA) with the added benefit that the way the user types is forms and extra identity check. The cherry on top is that the 2FA bit is done in-browser.

Can it replace Authy for Chrome?

Downsides? Apart from only supporting Chrome, each user account is only for that computer because encryption keys for services are stored locally. Adding a second computer means adding a second account.

Sums up the reason most won't be interested, or at least for home users.