Most people don’t realize it, but their typing patterns are remarkably distinctive.
So much so, in fact, that a Massachusetts-based security company is selling a product that can red-flag online bank customers whose patterns are suspiciously different than normal, and even limit access to bank accounts. But it’s more than that – the system can positively identify a customer using a number of factors: IP address, physical location, the time of day the user tries to log on, in addition to having a traditional barrier such as a password.
Delfigo Security, a new Cambridge-based company, officially launched the product in July. It’s in talks to sell its system to banking institutions, and has Children’s Hospital Boston on its list of clients thus far; the hospital uses it to safeguard information meant only for doctors and clinicians.
Other companies across the country have been marketing the idea that typing patterns are individualized enough to create a system that denies access to suspiciously different patterns, but Delfigo’s Bharat Nair says that’s not good enough to base the entire system on.
Never 100 Percent
People’s keystroke patterns can be remarkably consistent, but they can also change easily if you, for example, have a few beers at night or drink too much coffee in the morning, he said.
“We don’t try to argue an absolute guarantee that it is [the user] based on typing rhythm. [Some competitors are] trying to tell the market that ‘We can be 99.2 percent sure that it’s you.’ That’s impossible … if you bought into it, they’re a good storyteller,” he said.
The Delfigo system is calibrated to identify each user by a number of factors; but say, if the user’s physical location, password and all other factors are correct but the typing pattern is completely different, the system will ask the user to re-type the username and password, or perhaps allow that user into the system but restrict money transfers.
Delfigo’s system is meant to be an improvement over typical bank security systems that use fewer factors – such as the username/password combination, or a site key or challenge question – that can be easily thwarted by anyone who steals the user’s laptop or is simply a clever hacker, Nair said.
Delfigo appears to be a rare company in New England, but other companies elsewhere pitch a similar-sounding product.
Greater Fairfield County MLS installed a comparable system roughly a year ago from Washington-based AdmitOne Security, in an attempt to keep its real estate data restricted to proper users only – MLS subscribers are sometimes suspected of distributing their passwords around, and the company wanted to make sure users were the real deal.
Don Hull, CEO of Fairfield County MLS, says he’s been happy with the system. Initially the idea was to rely strongly on typing pattern and reject attempted loggers-on who seemed suspicious. But the system has been honed in the way that Nair describes Delfigo’s system – more accuracy based on location, IP address and other characteristics.
MLS’s concern was that the system would too often reject users who just happened to be typing slightly differently, Hull said; AdmitOne has adjusted the system to leave fewer disgruntled MLS subscribers who’ve been unjustly kept out.
“As the technology evolves, that sweet spot keeps getting a little bit closer and closer,” he said.
Matthew Shanahan, senior vice president with AdmitOne Security, says the company has sold security systems with keystroke-identification elements to about 20 credit unions and a handful of banking institutions in the past five years. He believes the overall concept will continue to evolve, and will eventually become more widespread.
It actually has a longer history than you’d think: The idea was first patented in the 1960s, he said, and even Morse code operators could be identified by the way they hit their dashes and dots.
“In terms of concept, it’s been around for awhile,” he said.
