Subscribe
Sign in
TypingDNA Authenticator — 2FA codes in your browser, secured by the way you type
Frictionless Authenticator based on the way you type. Google Authenticator desktop alternative that uses typing biometrics. No more switching devices.
29
Replies
@rrhoover so true! If keyloggers weren't bad enough, imagine if they were intelligent enough to track your typing patterns?!?
@rrhoover apps/sites should tell users when they record typing patterns, and if you've seen the demos, we explicitly add a typingdna logo and a visual typing pattern both in the demos and the authenticator. Like all biometric technologies out there, it has the potential for assisting surveillance, but for that all websites have to agree to track people for a higher entity... The promise, however, is to keep attackers out, keep thieves out of our bank accounts, email accounts, apps. The promise is to keep what's yours, well yours. We do this in real world too. People around you don't ask you for a password everytime you see you right? They look at you, or hear your voice, and conclude that you're yourself. Websites and apps should not lack similar abilities if we want to be 100% safe.
@rrhoover Its actually super awesome. This is a much more secure way of authenticating / having extra authentication layer thats seamless. As we are moving into the world of ambient biometrics things like TypingDNA will become more pervasive - we will be recognized by our Face, Voice, Fingerprints, Typing Patterns, etc.
@rrhoover yes indeed a creepy app for those who want to be invisible from web. Your keystrokes monitored its someone watching 👀 creeeepy
@itsnblackburn I'm thinking that this is something that probably means that you won't need password managers anymore. Common passwords won't be that insecure as you have the 2nd factor being your "typing DNA".
@itsnblackburn @swiftpolar passwords have become increasingly hard to remember and unusable. The point of a secret type of factor in authentication is to rely on something you know. We should be able to use simpler passwords, or just even similar passwords for multiple sites, things people use anyway.
@swiftpolar @itsnblackburn I agree, and I don't really subscribe to very simple passwords, but rather to combined factors of authentications: 2 weaker factors combined are much stronger then 1 single stronger factor.
@raulpopa don’t know how accurate is your pattern recognition, but I’m pretty sure I can type simple passwords such as “1234” or “qwerty”, the exact same way the user I’m trying to attack
Quite smart approach, but I don't wanna see this in use for myself. I want to be able to type with one hand at times or type at different speed (hand injury etc). I use a password manager to have random passwords on every single website and there is no way that I am going to type them by hand.
What if your credentials are stolen and a malicious website records the way you type?
I'm pretty sure IBM holds the patent for this approach. I had this idea 10-some years ago, and researched it, and IBM had it then. I think they called it "rhythmic password".
@kenneth_brogger_luplau there are a few patents 20+ years old that were covering the main things about how to record typing patterns for example, those are public domain now. Newer patents cover particular design approaches (like the one IBM may have) but no general approach. Also, one thing in particular is that TypingDNA approach is open sourced (released as Apache license): anyone can use our recorder class to record typing patterns the way we do. However, the main thing about what we do at TypingDNA sits on the back end, the AI based matching engine.
Is there a way for this to work if I am using a service like LastPass to manage my logins? Or do I have to type passwords every time?
@eugenoprea you still have to type but you can activate 2FA in Lastpass too and use TypingDNA Authenticator to unlock it.
Sort of wondering how you would access your accounts, for example, on mobile? or with a hand injury, broken keyboard keys...
@adam_kelly it can happen this is not bulletproof for sure. But then again this it's just a factor of authentication, TypingDNA Authenticator allows you to reset your typing pattern with your email. Other services that use TypingDNA API can fall back on 2FA SMS or other factors. Anyway, a more general truth is that it's still more likely to forget your password and that doesn't prevent apps from using passwords as the main authentication factor. The key is UX and convenience.
Interesting and terrifying as properly stated by @rrhoover!
Perhaps a stupid question, but it just came!
It looks like to gain access to the authenticator, you still need to provide an ID and password, which is tracked when typing to identify your typing pattern, right?
That said, it looks to me like a "password manager" for second-factor authentication. In that sense, using mobile apps (just like Google Authenticator) seems to be way simpler.
In any way, I'm curious ...
How would it work if I (truly) decide to share my password with someone else I really trust. Considering that person have a different typing pattern than mine, even though I share my TypingDNA credential to him/her, he/she would not have access to the second-factor authentication codes ... right?
Okay, this is frankly freaky. My wife and I tried it and it worked flawlessly. Such a cool concept, and as others have eluded to a bit scary to know that you can be identified just by the way you type. Coming to a DEFCON presentation soon near you. Certainly is an added layer of security for websites, and the real value I think is that my grandmother, who doesn't have good password discipline, could be better protected with this technology. Again, super cool!
@raulpopa All I know is that I was promised a damned hoverboard, and a proper one, not one of those damned fire catching death traps you stand on the wrong way.
I've stumbled across a lot of reads about identifying individuals based on typing patterns the last few years.
It's a very interesting concept and I love your implementation. Sounds scary to some but I can see mass adoption (mostly transparent, behind-the-scenes) throughout the years.
This is a good alternate or additive authentication factor for not only log ins, but multiple applications. Things such as proving you aren't a robot, fake account/bot prevention, or even e-contracts/signatures.
Keep pushing!
Product Hunt