why your keyboard can identify you (& the law can't stop it)

Behavioral Biometrics

The video examines behavioral biometrics—identifying or verifying people through patterns in how they type, move a mouse, or use a touchscreen. It argues that the technology is widely used, but that its accuracy and legal protections are often overstated.

What These Systems Measure

• Typing: How long keys are held and the pauses between keystrokes.
• Mouse movement: Features such as direction and curvature.
• Touchscreens: Around 30 swipe characteristics, including fingertip contact area and pressure.

These patterns may persist across devices, although some apparent recognition of a user may actually reflect differences in device hardware.

Accuracy and Testing

The video argues that reported accuracy depends heavily on how systems are tested:

• A Carnegie Mellon comparison used the same people, data, and algorithm, but changing the evaluation protocol shifted the reported error rate from 8.6% to about 1%.
• A 2022 Oxford study estimated that published touchscreen results overstated accuracy by 8.9 percentage points.
• A large 2023 challenge reported a 3.3% error rate, but at a setting where only 1% of outsiders were accepted, nearly 12% of legitimate users were reportedly blocked.
• The video contrasts these results with NIST’s much stricter biometric benchmark.

Time Needed to Collect Data

One cited mouse-dynamics result required 2,000 actions, or about 13.5 minutes of continuous activity. Reducing the sample to 4.5 minutes reportedly raised the false-positive rate to 24%.

Testing Users Without Their Knowledge

The video discusses a granted US patent for an “invisible challenge.” Software can subtly divert a cursor from its intended target and measure how the user corrects the movement. The patent describes making the disruption difficult to notice.

The video characterizes this as an active test that elicits a more informative response than passive observation.

Imitation and Deliberate Attacks

In a 2013 study described in the video, attackers practiced matching victims’ typing speeds. Their success rates increased substantially with feedback and, especially, access to a victim’s keystroke statistics; the latter reportedly reached 99.2% in the test. The video says the researchers concluded that keyboard dynamics were unsuitable as a standalone authentication method.

It also notes that some other imitation attempts, such as copied gait or machine-generated mouse paths, were less successful.

The video says an international biometric testing standard excludes errors caused by people intentionally trying to defeat a system. It argues that this may make systems appear more robust in standard evaluations than they are against informed attackers.

Legal Protections

The video describes a gap between laws that define behavioral traits as biometric information and provisions that allow people to sue:

• California’s privacy law names keystroke patterns as biometric information, but the provision allowing lawsuits uses a narrower definition.
• Illinois’ lawsuit provision, as described in the video, lists physiological scans but not typing or mouse dynamics.
• A 2021 student case against an online exam-proctoring company was dismissed after a contract’s jurisdiction clause sent it to Alabama law. The appeal was withdrawn.
• The video notes that behavioral biometrics has not appeared in published US court decisions under that terminology.

Deployment and Removal

Coursera reportedly began using the act of typing a statement of academic honesty as an identity check in 2013, without publishing accuracy figures. The feature later disappeared from its materials without a public announcement or changelog entry.

The video also notes that NIST classifies typing and other behavioral traits as biometrics, but does not offer comparable public testing programs for typing, mouse movement, touch, or gait.

Practical Advice

The video’s practical advice is limited: users may be able to check whether their bank uses behavioral biometrics. It also says California residents have a documented right to restrict the use of sensitive biometric information.

Reviews, Guides, or Tutorials

None are presented. The video is an explanatory analysis of the technology, its evaluation, attacks, and legal treatment.

Main Speaker and Sources

The host introduces himself as Eddie; the channel is Addie LaMarr. Sources discussed include Carnegie Mellon researchers, an Oxford study, NIST, a 2023 biometric challenge, researchers who conducted a 2013 keystroke-impersonation study, a behavioral-biometrics patent, and historical Coursera materials.