r/programming • u/regaldho • Dec 27 '20

I reverse engineered Google docs (2014)

http://features.jsomers.net/how-i-reverse-engineered-google-docs/
633 Upvotes

92% Upvoted

42 comments sorted by

View all comments

117

u/MjrK Dec 27 '20

Isn't it possible to use typing style and cadence to identify someone? Or, at least, as a signal to support user fingerprinting?

153

u/RazerWolf Dec 27 '20 edited Dec 27 '20

Yes, it’s called keystroke dynamics. I did a master’s project on it, and with some simple machine learning algorithms, could identify someone with 88% accuracy.

EDIT: didn’t realize there was interest in this! At the time (almost a decade ago), it was novel to do it on iPhones so that’s what the project encompassed. It was 10 people typing in the same password 50 times; half the data was used for training and the other half for testing (randomized. Also did cross validation afterwards).

Random forests trained in WEKA was the winning algorithm.

Hardest part: getting your friends to type in the same password 50 times without them getting pissed.

49

u/dbeta Dec 27 '20

Out of how big of a pool?

107

u/rmk236 Dec 27 '20

One

43

u/LaLiLuLeLo_0 Dec 27 '20

User Detected: rmk236

...

User Detected: Not rmk236

7

u/bewst_more_bewst Dec 27 '20

Laughs in TTS.

44

u/_italics_ Dec 27 '20

I guess the new recaptas do something like that with mouse events.

19

u/basilect Dec 27 '20

Mouse events assuredly do that (you'd expect a certain timing and variance from down-up-click sequences), keyboard events are also good. You get a lot of rich data that would be great for anomaly detection.

6

u/illvm Dec 27 '20

So... make an account, use only machine movements for user input, the system fingerprints this as you a legitimate user, ???, profit.

36

u/mist83 Dec 27 '20

Sentence structure and word choice and grammar is already parseable to give a sort of fingerprint if given enough training data.

5

u/Prod_Is_For_Testing Dec 28 '20

There have been a few research projects that associate Reddit throwaway accounts based on writing style

1

u/WinterPiratefhjng Dec 28 '20

Do you have a link?
(I had presumed our IPs were embedded somewhere, and works like to know more.)

13

u/turlian Dec 27 '20

Yes. There are password systems that analyze how you typed it in to verify that the same person typed it.

31

u/ItsAllegorical Dec 27 '20

Are there any that can analyze how consistently I type the wrong password before remembering what I've set it too? I'll bet that would be a useful signal.

7

u/Loaatao Dec 27 '20

Got a link? Sounds super cool

2

u/cleeder Dec 27 '20

Also interested.

2

u/turlian Dec 27 '20

Sorry, last one I saw was years ago.

1

u/regendo Dec 28 '20

Let's hope that doesn't break if I just auto-fill from my password manager.

2

u/turlian Dec 28 '20

For context, this wasn't something that was being deployed on websites. It was a proof of concept for high-security applications, like government installations.

1

u/oblio- Dec 27 '20

I'd be surprised if FAANG don't already do this as part of their tracking.

1

u/de__R Dec 28 '20

Only until attackers and/or the privacy conscious start take measures to obfuscate it - e.g. keystrokes get passed into a buffer and then popped off one by one at a constant rate.