Live data from Hacker News

Behavioral Profiling: The password you can't change

paul.reviews

81–90 of 99 posts

Re: Behavioral Profiling: The password you can't change

#81
post #80
post #79

Earlier quoted context omitted.

I tried NoScript for a bit. Obviously most social networks stopped working, but I liked how NYT became free again (since they track you by a cookie) and obviously HN remained solid. Essentially NoScript just means no online socializing, which I think I might grow to become ok with.

Don't forget that you can whitelist domains, or disable/enable them per session.

Yep, I actually just learned that a minute ago. Thanks for the tip. :)

Re: Behavioral Profiling: The password you can't change

#83
post #25
post #17

What a huge nightmare waiting to happen. Sites already give me shit for changing my location, making me jump through additional hoops because my browser signature changed, refusing to let me purchase something because I don't access them from my home country. The last thing I need is a behavioral profiler that insists it has determined I'm not me and there is nothing I can do to prove it wrong.

True - I was thinking "what happens if I burn my finger while cooking?" It does seem like a solution looking for a problem.

Or, what if I learn to touch type?

Re: Behavioral Profiling: The password you can't change

#84
post #30

Earlier quoted context omitted.

Or, what if I've had a few beers and my typing is getting sloppier.

If it's trying to prevent you from doing bank transfers while inebriated, I'd say it's working as intended.

I think there's a whole industry being ignored here - "Are you sure you want to post this to Facebook? Your typing is all over the place." or "Maybe we'll just delay sending that text message for a few hours to make sure future you really thinks it's a good idea."

Re: Behavioral Profiling: The password you can't change

#85

Earlier quoted context omitted.

It was true at one stage, according to official acknowledgement form Facebook. There's a discussion somewhere here on Hacker News. Can't find the link right now.

Not quite. Here's a blog post from someone who read the study, and quotes from it: http://www.dailykos.com/story/2013/12/16/1263165/--Facebook-...

I stand corrected. Thanks.

Re: Behavioral Profiling: The password you can't change

#86

Well, yes you can change your behavior, and no, this is not a good idea. We worked in biometrics like 4 years ago or so. It is trivial to defeat this "security mechanism". We had snake oil people trying to convince us to invest in this(we are a software company), so we made a bet: If we could defeat their marvelous thing on a test they will pay all of our tester team a dinner(and go away and don't bother us again). I…

It doesn't even add another factor, really. If I can trick you into revealing your password, I can capture your typing pattern at the same time. Same goes for snooping or compromising other sites' auth DBs. At best this adds a bit of entropy that you don't need to remember, but it's probably not much, and you can't change it...

Re: Behavioral Profiling: The password you can't change

#87

Earlier quoted context omitted.

These sorts of techniques have widespread applicability. Who needs facial recognition when you have kinematic behavioral analysis? Just imagine the trove of data you could pull from existing information sources if you had unlimited analytical time and computational power? As computing power becomes even cheaper and various analytical techniques become better our "effective privacy" window in our partially-anonymous s…

That's why I'm still entertaining the thought that we may be a "privacy vs. progress of mankind, chose one" type of situation. "These sorts of techniques" are the first scraches on the Great Web of Causality. I don't see a way to prevent it short of banning general-purpose computation. But are we going to deny ourselves all the advances in medicine, disaster relief, energy efficiency, etc. to protect ourselves from s…

I think that the final destination here is going to be a near-complete lack of privacy in human relationships. Everybody is going to be able to look up everyone else's porn habits. Everyone one is going to know who does drugs, and who's cheating on who.

And as a society I think we're going to need coping strategies. Trying to protect privacy is only going to delay the eventual meltdown of privacy in our lives.

I think we are making good strides already though. There is less stigma around porn, around homosexuality, around fetishes. Religious tolerance also seems to be increasing. There are still problem points, but I think the trends are in the right direction. I'm happy to be proven wrong on this point though.

Re: Behavioral Profiling: The password you can't change

#88

Well, yes you can change your behavior, and no, this is not a good idea. We worked in biometrics like 4 years ago or so. It is trivial to defeat this "security mechanism". We had snake oil people trying to convince us to invest in this(we are a software company), so we made a bet: If we could defeat their marvelous thing on a test they will pay all of our tester team a dinner(and go away and don't bother us again). I…

I'm honestly more worried Google or an advertising company would be using this technique than its value as a security mechanism. It'd just be one more chunk of information in the browser fingerprinting process. Changing your natural, habitual behavior is hard . The sad part is, this probably would be pretty effective at catching bots due to the fact they likely are largely repetitive and/or skip the mouse move to sim…

Isn't Google's new capcha system something similar already? https://www.youtube.com/watch?v=jwslDn3ImM0

Re: Behavioral Profiling: The password you can't change

#89

Earlier quoted context omitted.

Not quite. Here's a blog post from someone who read the study, and quotes from it: http://www.dailykos.com/story/2013/12/16/1263165/--Facebook-...

I stand corrected. Thanks.

I didn't realise either until I read that, fwiw :-)

Re: Behavioral Profiling: The password you can't change

#90
Imagine the behavior profiler learning enough to notice trends and even changes in groups. Imagine if it could identify enough to determine people who had previously been sexually victimized. I wonder how much that type of data could sell for.

My problem with all of this prfiling/bio-metrics is an extension of the problem with retinal scanning. It isn't a question of if it works or not, but of what information other than identity does it leak.

Post reply on HN