Another way to identify users is by the speed and rhythm they type their username and password.

For example, let's think about a hypothetical company that sells a per-seat license to a database, that wants to determine if multiple people are using a license for a single seat without false positives. The easiest case to detect are multiple concurrent logins from different IPs. However, if the service/database is used less frequently and concurrent logins would not occur, then it will be harder to catch. Detecting this is made more challenging because one user might login from different IPs, computers, operating system, browsers, etc.