Behavioral Profiling: The password you can't change • Hacker News Board

Re: Behavioral Profiling: The password you can't change

#51

Post by arihant » Thu, Jul 30, 2015, 11:56 AM UTC

I hope these services have an opt-out. I know, I know, this will get infinitely more accurate at an arbitrary point in the future, and that I won't have complaints then.

But I get screwed constantly while travelling to other countries, getting repeatedly locked out of Gmail. Again, most users won't face these issues. But I don't want to live in a world where if you're not a nominal case, you're screwed.

The people who think passwords are hard will keep getting older and will be washed away. The generation coming in thinks paper is a broken iPad. So exactly, why do we need to solve the problem of passwords, when even slightly savvy users can handle it. Is it so hard to figure out that not too long in future, you can expect all your users to be comfortably savvy?

Also, passwords are deterministic and are a better UI. The Android Lollipop's on-body smart lock, for example, is pure non-deterministic headache. Haven't we gone through this with automatic sliding doors already?

Re: Behavioral Profiling: The password you can't change

#52

Post by [deleted] » Thu, Jul 30, 2015, 11:56 AM UTC

indymike wrote: post #41

Udo wrote: post #17

What a huge nightmare waiting to happen. Sites already give me shit for changing my location, making me jump through additional hoops because my browser signature changed, refusing to let me purchase something because I don't access them from my home country. The last thing I need is a behavioral profiler that insists it has determined I'm not me and there is nothing I can do to prove it wrong.

One of the banks I use had a keyboard profiling feature on their login page for three or four years and discontinued it in the last year or so. The reason: customers hated it because it did not work well enough (i.e. it would reject your login 3-4 times before accepting it).

[deleted]

Re: Behavioral Profiling: The password you can't change

#53

Post by artursapek » Thu, Jul 30, 2015, 12:02 PM UTC

typis7 wrote: post #47

Aoyagi wrote: post #46

Earlier quoted context omitted.

Yes. It's annoying, because it taunts me with efforless click once or twice a day while it wastes my time with the annoying image matching for the rest of the day.

I blocked the domain. If the site presents me with a re-captcha, I don't even have to think whether to use that site.

That's a pretty dismissive attitude. We recently added reCAPTCHA to our sign up flow at Codecademy and it helped combat spam a lot. The site was harder to manage and moderate before we took that little step.

Assuming all websites using reCAPTCHA are not worth using seems ridiculous to me.

Re: Behavioral Profiling: The password you can't change

#54

Post by troels » Thu, Jul 30, 2015, 12:06 PM UTC

mdpopescu wrote: post #35

Udo wrote: post #32

Earlier quoted context omitted.

The article doesn't make it sound like this would be a first line of defense, in fact the author seems quite adamant about its infallibility, but even if such algorithms would be used conservatively it would still be a huge hassle. Imagine every major website nudging you with a popup every once in a while: " we don't like the way you're typing, please use our code generator mobile app to prove it's still you ". I all…

Google started doing this to me; I've had a similar message pop up three times in the last week.

They do it if you are on a shared network (like in an office) and someone on the network did something Google doesn't like. Such as scraping them.

Re: Behavioral Profiling: The password you can't change

#55

Post by typis7 » Thu, Jul 30, 2015, 12:23 PM UTC

artursapek wrote: post #53

typis7 wrote: post #47

Earlier quoted context omitted.

I blocked the domain. If the site presents me with a re-captcha, I don't even have to think whether to use that site.

That's a pretty dismissive attitude. We recently added reCAPTCHA to our sign up flow at Codecademy and it helped combat spam a lot. The site was harder to manage and moderate before we took that little step. Assuming all websites using reCAPTCHA are not worth using seems ridiculous to me.

Captchas are dismissive towards users.

You throw humans and robots in the same basket and tell all of them to solve a puzzle or you won't talk to them.

Re: Behavioral Profiling: The password you can't change

#56

Post by Aoyagi » Thu, Jul 30, 2015, 12:24 PM UTC

typis7 wrote: post #47

Aoyagi wrote: post #46

Earlier quoted context omitted.

Yes. It's annoying, because it taunts me with efforless click once or twice a day while it wastes my time with the annoying image matching for the rest of the day.

I blocked the domain. If the site presents me with a re-captcha, I don't even have to think whether to use that site.

I guess that can be healthy since that plug-in is undoubtedly used for Google's own profiling to somehow sell more ads, heh.

Re: Behavioral Profiling: The password you can't change

#57

Post by typis7 » Thu, Jul 30, 2015, 12:27 PM UTC

Aoyagi wrote: post #56

typis7 wrote: post #47

Earlier quoted context omitted.

I blocked the domain. If the site presents me with a re-captcha, I don't even have to think whether to use that site.

I guess that can be healthy since that plug-in is undoubtedly used for Google's own profiling to somehow sell more ads, heh.

Don't worry, there are additional blocked domains just for that. :-)

Re: Behavioral Profiling: The password you can't change

#58

Post by wtbob » Thu, Jul 30, 2015, 12:33 PM UTC

Yet another reason not to enable JavaScript in the browser…

And then there's Rowhammer (http://googleprojectzero.blogspot.com/2015/03/exploiting-dra...).

Re: Behavioral Profiling: The password you can't change

#59

Post by bitL » Thu, Jul 30, 2015, 12:33 PM UTC

Udo wrote: post #17

What a huge nightmare waiting to happen. Sites already give me shit for changing my location, making me jump through additional hoops because my browser signature changed, refusing to let me purchase something because I don't access them from my home country. The last thing I need is a behavioral profiler that insists it has determined I'm not me and there is nothing I can do to prove it wrong.

Get your own personal assistant robot, Intel Jimmy-style, switch into a personality profile of your choice (I am in an Amazon mood today, next I want to shop on eBay etc.) and voilà! Pas de problème!

Re: Behavioral Profiling: The password you can't change

#60

Post by coldpie » Thu, Jul 30, 2015, 12:40 PM UTC

typis7 wrote: post #55

artursapek wrote: post #53

Earlier quoted context omitted.

That's a pretty dismissive attitude. We recently added reCAPTCHA to our sign up flow at Codecademy and it helped combat spam a lot. The site was harder to manage and moderate before we took that little step. Assuming all websites using reCAPTCHA are not worth using seems ridiculous to me.

Captchas are dismissive towards users. You throw humans and robots in the same basket and tell all of them to solve a puzzle or you won't talk to them.

I understand your point, but do you have a better suggestion to solve the spam problem? It's a really hard problem, and CAPTCHAs do a reasonable job of solving it at low cost to the end user.