Hacker News Reader

Comment by blakesterz | Hacker News Reader

After reading this one I'm not sure this is as bad as I thought it would be based on the headline:

"On new account applications, for example, behavioral biometric systems pay close attention to where and when applicants pause. A legitimate applicant typically types personal information — their name, their address, their Social Security number — fluidly, with few breaks. A scammer will often either cut and paste or take breaks to consult their notes."

It's currently used to do security checks. And it's being done while your interacting with the site/app. Seems like a useful security check, though I suppose there's some potential for abuse, somehow?

I think Google's CAPCHTCA thing does this too? It watches how your mouse moves and knows your a real person (or something close to that).

View on HN

> though I suppose there's some potential for abuse, somehow?

One day you want to post online a video obtained through illegal means (for example you film animal abuse in a US abatory), you buy a burner phone and go to an open Wifi, but the behavioral fingerprint you left behind while using YouTube is used to track you down.

I guess this is still fair game, you were breaking the law after all, but you get the idea.

I really really doubt you could get such a specific fingerprint and even so, you could automate video uploading to YouTube in a script

Unfortunately, this simplistic behavior modeling ends up being incompatible with autofill and password managers.

My bank's in-app password reset tool clears all fields and requires you to restart if the app is suspended mid-form. It also disables copy + paste into the app fields. And, their identity verification involves texting you a 10-digit security code, which falls just outside of most people's working memory.

And I use it often, because their password requirements are incredibly specific - so specific they cripple the search space - and they won't allow password manager pasting. Of course, if I made my password "dragondragondragon1!", they'd happily accept it and I'd never have to use their torturous interface.

It's amazing how far security features can go in being both anti-user and anti-security.

In Firefox you can change the setting dom.event.clipboardevents.enabled to false to prevent the absurd past-blocking behavior.

I guess it's a good thing that nobody with kids, a disability, or any other distractions ever fills out online forms when other things are happening in their homes, then!

I have often had my typing of personal information interrupted by my dog coming up and pushing my hand while I'm typing. Guess I wouldn't be able to apply for a loan from these people. Sheesh. What useless poppycock.

It's a signal. False positives need to be handled in some way. For captcha, they give you a captcha. For payments type stuff it's likely just one of hundreds of signals you can use to build a score that can raise a manual review above a certain threshold.

There is a company or two in this space that do an OK job of it.

The easy way around this as a scammer is to have the reference material visible beside the screen. I suspect it's another layer to augment existing verification checks. I do wonder about the false negative rate.

Reply on news.ycombinator.com