Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Behavioral Profiling: The password you can't change

paul.reviews

Post reply on HN
Print view View original

91–99 of 99 posts

Re: Behavioral Profiling: The password you can't change

#91

Post by fweespeech »

n3o59hf wrote: post #88
fweespeech wrote: post #76

Earlier quoted context omitted.

I'm honestly more worried Google or an advertising company would be using this technique than its value as a security mechanism. It'd just be one more chunk of information in the browser fingerprinting process. Changing your natural, habitual behavior is hard . The sad part is, this probably would be pretty effective at catching bots due to the fact they likely are largely repetitive and/or skip the mouse move to sim…

Isn't Google's new capcha system something similar already? https://www.youtube.com/watch?v=jwslDn3ImM0

Yes, but they could include it on all google products.

Re: Behavioral Profiling: The password you can't change

#92

Post by dsp1234 »

artursapek wrote: post #53
typis7 wrote: post #47

Earlier quoted context omitted.

I blocked the domain. If the site presents me with a re-captcha, I don't even have to think whether to use that site.

That's a pretty dismissive attitude. We recently added reCAPTCHA to our sign up flow at Codecademy and it helped combat spam a lot. The site was harder to manage and moderate before we took that little step. Assuming all websites using reCAPTCHA are not worth using seems ridiculous to me.

This is like the places that make me store my backpack behind the counter while I'm shopping. Yes, I totally get that it's one way to combat theft, but it's also treating me like I might steal something. From a UX perspective, it's hostile. I'm having to do work to solve a problem that I've never been the cause of. So if I have a choice, I don't visit those establishments a second time. They have chosen to put those extra roadblocks in place, and I've chosen to go somewhere where I don't feel like I'm getting punished for someone else's crime. Seems like a win/win to me.

To suggest it's a "dismissive attitude" to not want to be hassled due to some other bad actor implies looking at it from the business perspective, and not necessarily from the perspective of the effect it has on users.

Re: Behavioral Profiling: The password you can't change

#93

Post by ThomPete »

logfromblammo wrote: post #77
ThomPete wrote: post #66

Earlier quoted context omitted.

Although you are of course right there is something underlying interesting about what could be done to track us in order to build a unique "ghost" of us that can can be used for many purposes beyond logging in. But given I am not an expert in this field I would like to turn around and perhaps ask you, what is the bigger vision? Surely biometrics in all sorts of shapes and forms comes with it's own issues and shortcom…

This concept was used in _The Dosadi Experiment_ , by Frank Herbert. The Dosadis would input all available information on an adversary into a computer, and build a personality model of them. They would then run game scenarios against the model to find the optimal strategies to achieve some desired goal. If you can assemble an AI copy of someone, you have an almost unbeatable weapon against him. You can make him do th…

Agree, the question I guess is if there is any research into finding a way to make the ghost "part of your dna" in some way so that it's tied to you and you to it?

I know this is probably naive sci-fi but I have heard crazier things. I guess at the end of the day it requires that the interfacing is not just digital but also somehow biological/genetic.

Re: Behavioral Profiling: The password you can't change

#95

Post by therobot24 »

ThomPete wrote: post #66
Htsthbjig wrote: post #62

Well, yes you can change your behavior, and no, this is not a good idea. We worked in biometrics like 4 years ago or so. It is trivial to defeat this "security mechanism". We had snake oil people trying to convince us to invest in this(we are a software company), so we made a bet: If we could defeat their marvelous thing on a test they will pay all of our tester team a dinner(and go away and don't bother us again). I…

Although you are of course right there is something underlying interesting about what could be done to track us in order to build a unique "ghost" of us that can can be used for many purposes beyond logging in. But given I am not an expert in this field I would like to turn around and perhaps ask you, what is the bigger vision? Surely biometrics in all sorts of shapes and forms comes with it's own issues and shortcom…

> Surely biometrics in all sorts of shapes and forms comes with it's own issues and shortcomings.

Indeed. A behavioral biometric like this is probably most similar to gait recognition (identifying someone by they way they walk). It's slightly better than a 'soft biometric' like skin color and gender, but not good enough for any type of large scale deployment. Usually when researchers show this stuff it's more or less for novelty. With that in mind, there really shouldn't be a 'bigger vision' because recognition rates are usually not good enough to merit anything other than an occasional paper.

Re: Behavioral Profiling: The password you can't change

#96

Post by [deleted] »

logfromblammo wrote: post #77
ThomPete wrote: post #66

Earlier quoted context omitted.

Although you are of course right there is something underlying interesting about what could be done to track us in order to build a unique "ghost" of us that can can be used for many purposes beyond logging in. But given I am not an expert in this field I would like to turn around and perhaps ask you, what is the bigger vision? Surely biometrics in all sorts of shapes and forms comes with it's own issues and shortcom…

This concept was used in _The Dosadi Experiment_ , by Frank Herbert. The Dosadis would input all available information on an adversary into a computer, and build a personality model of them. They would then run game scenarios against the model to find the optimal strategies to achieve some desired goal. If you can assemble an AI copy of someone, you have an almost unbeatable weapon against him. You can make him do th…

[deleted]

Re: Behavioral Profiling: The password you can't change

#97

Post by tom-lord »

_swa8 wrote: post #78
tom-lord wrote: post #69

Earlier quoted context omitted.

> the claim that [...] What are you talking about? The comment I replied to didn't make any such claims! > passwords must be changeable Not necessarily. What about fingerprints? > usernames need not be changeable Not necessarily. What about National Insurance / Social Security numbers?

Fingerprints are usernames, not passwords, even if some people use them as passwords. What's the point of a password you can't change? Once it leaks, you're screwed forever. In the autenticaion realm, there's three main things used: a) who you are ("username") b) what you know ("password") and c) what you have (smartcard, various kinds of dongles). Biometrics of any kind only fit in the first category. The other two…

> Fingerprints are usernames, not passwords, even if some people use them as passwords.

This doesn't make sense. You cannot "use a username as a password".

Fingerprints, retina scans, DNA samples, etc are biometric passwords. They are unique identifiers to your identification, and cannot be changed for obvious reasons.

Re: Behavioral Profiling: The password you can't change

#98

Post by jessaustin »

tom-lord wrote: post #97
_swa8 wrote: post #78

Earlier quoted context omitted.

Fingerprints are usernames, not passwords, even if some people use them as passwords. What's the point of a password you can't change? Once it leaks, you're screwed forever. In the autenticaion realm, there's three main things used: a) who you are ("username") b) what you know ("password") and c) what you have (smartcard, various kinds of dongles). Biometrics of any kind only fit in the first category. The other two…

> Fingerprints are usernames, not passwords, even if some people use them as passwords. This doesn't make sense. You cannot "use a username as a password". Fingerprints, retina scans, DNA samples, etc are biometric passwords. They are unique identifiers to your identification, and cannot be changed for obvious reasons.

Please reread this thread. The reason 'liw and I are on the same page, and you literally denied that 'liw said what we can all read 'liw saying three inches above, is that you simply haven't thought deeply enough about this topic.

The entire concept of "biometric passwords" is flawed, because as you see, they "cannot be changed for obvious reasons". One of the most important things about passwords (and passphrases!) is that they may be changed at any time. Every time there is an unauthorized data dump, we get lists of thousands of passwords or hashes thereof. Therefore, anyone who protects important assets with passwords should change them regularly. Anyone whose biometric data is stored in a database will eventually have that dumped as well.

The day is quickly approaching when none of these biometric measures will be private anyway. With that in mind, they could perhaps be used as public identifiers, "usernames" if you will. In that sense they might be similar to the SSN, another datum that is clearly unsuitable as a password, even though hundreds of stupid organizations have used it as such.

Re: Behavioral Profiling: The password you can't change

#99

Post by jessaustin »

dhmholley wrote: post #36
tom-lord wrote: post #20

Earlier quoted context omitted.

There are plenty of sites that allow you to change your username!

(Though unfortunately not HN)

There's nothing stopping you from registering a new user, using the "about" section at https://news.ycombinator.com/user?id=dhmholley to point to that new user, and perhaps even pointing back at 'dmholley from the new user. Your name would be changed, and everyone would know it.

The only thing that wouldn't transfer would be your valuable internet points.

Post reply on HN