Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Typing.ai – Secure typing biometrics authentication API

typing.ai

Post reply on HN
Print view View original

11–16 of 16 posts

Re: Show HN: Typing.ai – Secure typing biometrics authentication API

#11

Post by mcaravey »

ChicagoBoy11 wrote: post #4

Has anyone who has used this sort of tech before comment as to its validity and accuracy, especially over time? The first time I saw something like this was in a MOOC platform that used this sort of typing biometric to try to make sure that students were not cheating. That seemed to make sense to me, because I get that you could collect a relatively large sample of writing from the course and then match it to whateve…

My bank tried to add typing heuristics on the password box years ago. It wouldn’t lock you out, but you had to go through extra verification steps if you failed. I failed the test pretty much every time I logged in, and I’m sure it happened a lot because 6 months later it was gone. In that use case it was an extra attempt at locking down bank access, which I can appreciate, but I hated that it was wrong most of the time.

Re: Show HN: Typing.ai – Secure typing biometrics authentication API

#12

Post by raresp »

mcaravey wrote: post #11
ChicagoBoy11 wrote: post #4

Has anyone who has used this sort of tech before comment as to its validity and accuracy, especially over time? The first time I saw something like this was in a MOOC platform that used this sort of typing biometric to try to make sure that students were not cheating. That seemed to make sense to me, because I get that you could collect a relatively large sample of writing from the course and then match it to whateve…

My bank tried to add typing heuristics on the password box years ago. It wouldn’t lock you out, but you had to go through extra verification steps if you failed. I failed the test pretty much every time I logged in, and I’m sure it happened a lot because 6 months later it was gone. In that use case it was an extra attempt at locking down bank access, which I can appreciate, but I hated that it was wrong most of the t…

Our API returns a signature detection percentage. We recommend our users to accept users with a signature accuracy score of over 80%.

What does this means? When you type in the morning or late at night you have a different typing pattern. When you are tired or drunk, you have a different keystroke pattern, but still, our algorithm is able to identify you. You won't have a 90% matching score, but you will still have over 80% signature matching score.

This is why Typing AI's algorithm is better than our competitors.

Re: Show HN: Typing.ai – Secure typing biometrics authentication API

#13

Post by raresp »

xaedes wrote: post #10
raresp wrote: post #6

Earlier quoted context omitted.

Thanks for your questions. Regarding: "However, this is claiming to authenticate me as an individual. But what if my writing improves? What if I have a mechanical keyboard at work but a rinky-dink iPad case soft keyboard at home?" You will have to create separate typing signatures in order to cover both desktop and mobile apps, because mobile typing is totally different than the computer's keybord typing. Typing AI i…

Do I read that right? 1 in 1000 are false positives? Does that mean 1 in 1000 users can log in as another by chance? That is no authentication scheme then.

Very good question.

Simple answer - No, you won't be able to login as another by chance. You understood it wrong. If 1000 users try to login as you, the results of our statistics show that one of them may be able to do it.

But if you combine typing biometrics with other authentication factors, using it as a two factor authentication (2FA) or as a multi factor authentication (MFA) solution, this scenario won't exist at all.

So yes, typing biometrics is a very strong and efficient authentication method.

Re: Show HN: Typing.ai – Secure typing biometrics authentication API

#14

Post by xaedes »

raresp wrote: post #13
xaedes wrote: post #10

Earlier quoted context omitted.

Do I read that right? 1 in 1000 are false positives? Does that mean 1 in 1000 users can log in as another by chance? That is no authentication scheme then.

Very good question. Simple answer - No, you won't be able to login as another by chance. You understood it wrong. If 1000 users try to login as you, the results of our statistics show that one of them may be able to do it. But if you combine typing biometrics with other authentication factors, using it as a two factor authentication (2FA) or as a multi factor authentication (MFA) solution, this scenario won't exist a…

> If 1000 users try to login as you, the results of our statistics show that one of them may be able to do it.

So each user effectively gets assigned one of ~1000 ids, which is not that different to a three digit decimal PIN, that they then can use as password?

It seems to use it as an authentication scheme a username and 2FA/MFA is _mandatory_. I guess one could then also say: a username is a very strong and efficient authentication method.

Re: Show HN: Typing.ai – Secure typing biometrics authentication API

#15

Post by raresp »

xaedes wrote: post #14
raresp wrote: post #13

Earlier quoted context omitted.

Very good question. Simple answer - No, you won't be able to login as another by chance. You understood it wrong. If 1000 users try to login as you, the results of our statistics show that one of them may be able to do it. But if you combine typing biometrics with other authentication factors, using it as a two factor authentication (2FA) or as a multi factor authentication (MFA) solution, this scenario won't exist a…

> If 1000 users try to login as you, the results of our statistics show that one of them may be able to do it. So each user effectively gets assigned one of ~1000 ids, which is not that different to a three digit decimal PIN, that they then can use as password? It seems to use it as an authentication scheme a username and 2FA/MFA is _mandatory_. I guess one could then also say: a username is a very strong and efficie…

I like the fact that you are playing with my words.

I didn't said that we have 1000 id's or that we are limited when creating the typing signatures. I said that we have a 99.9% detection accuracy score.

Each signature translates into a unique and encrypted hash with a length of over 300 characters. Compare that with an 8 characters unencrypted password, or with a 64 characters encrypted password and you'll be able to decide for yourself which security is better and more efficient.

Thanks for your interest in Typing AI.

Re: Show HN: Typing.ai – Secure typing biometrics authentication API

#16

Post by 8organicbits »

I'm thinking about the password replacement use case. If an attacker (somehow) was to profile my typing, presumably they'd be able to replay keystrokes matching my own. Is there a way to "change my password" in those scenarios, or are there some sort of liveness checks you can perform to defeat replay?

I registered, but I was surprised to see the registration used username+password. I suppose different use cases require different tech, but that was unexpected.

Post reply on HN