Password Typos and How to Correct Them Securely (2016) [pdf]
ieee-security.org
ieee-security.org
My initial thought was that such a system would decrease security, but the idea of increasing legitimate user login success rates is very interesting. This could also decrease the volume of password reset requests.
Of course if the user were pasting their credentials in from a password manager this feature wouldn't make any difference, but until our industry can create solutions with much less authentication friction we are likely to see users continue to do what the majority of them are used to already doing.
EDIT: The authors are probably too modest to tout this, so I'll do it for them: this work won "Best Student Paper" at IEEE Security and Privacy last year.
Total blue sky it, or describe it in principle. We are basically approaching the theoretical minimum in regards to friction. We have a lot of solutions that accept large decreases in security for small improvements in ease of use in an attempt to attract users.
Users don't want these tools. It's not friction, it's a complete disinterest from users. Maybe there is some theoretical approach with less friction that would win everyone over but this analysis of what the problem is stinks of tech solutionism to me.
There are gains to be made in situations where I'm using another computer, or my phone, or the password manager isn't recognizing the site properly, or isn't finding the right the input fields.
But mostly the friction is in front of all those users who don't use password managers. There are gains to be made in making the setup process simple, secure, and predictable. There are gains in making it cross-browser, cross-platform, and well-integrated with the setup process for browsers and operating systems.
Users "don't want" most things, until a lot of thought and effort gets made to create a wholistic solutions that just work.
However, I'm not sure if hardware solutions like yubikey solve this (particularly for initial logon, or "interfaces", like a computer serving solely as a printer terminal)
But anyways, the easy case is when the manager is trivially available; the hard case to solve is when its not. You can instead imagine a world where all computers by standard support some interface for hardware login in all states of operation, and by standard practice, people keep this hardware on them, and you'd have a significant improvement on the state of affairs. (ie nfc authentication by phone)
I don't buy the idea that being typo tolerant only helps the real account owner if it's also opaquely increasing the amount of password reuse across sites. Not to mention that the code handling the typo comparison is a pretty large new surface area for attack, all in the name of optimizing the experience for typing passwords by hand (a practice we should actively reduce).
Whether this would be a net win or not I don't know.