14

Today, Stack Overflow released their April Fool's joke (a day early, but hey) involving Dance Dance Authentication.

Essentially, it's logging you in by dancing in front of your PC, and it can recognize multiple dance styles. The video is worth a watch, because it's hard to explain how this works.

Now, obviously, this is a joke, but could this actually somehow be made to work as a way to log in? And could this ever be secure?

Improve this question
3
  • 1
    Related if not duplicate security.stackexchange.com/q/155367/86652
    – techraf
    Mar 31, 2017 at 8:38
  • 2
    It's a form of behavioural analytics. Similar processes have been legitimately studied for keystroke analysis (timing and speed between various keys used when typing a password).
    – schroeder ♦
    Mar 31, 2017 at 8:56
  • 1
    @schroeder A Dance Dance authentication could combine behavioural analysis with realtime face recognition.
    – S.L. Barth is on codidact.com
    Mar 31, 2017 at 8:58

1 Answer 1

Reset to default
9

Any analysis of a human's behaviour has the potential to be used as a form of authentication (keystroke analysis), but there are problems if you attempt to make it a primary authentication factor.

It is far better to use biometric characteristics instead of behaviour as there is less chance for change from attempt to attempt in normal operation. Fingerprints don't change throughout the day, but your enthusiasm while dancing (or typing) can wax and wane depending on your coffee intake.

At best, it might be possible to use behavioural analysis as a "confidence factor" where, if successful, could be used as a part of a second factor for authentication, but failure could not be regarded as a login attempt failure (i.e. not a login failure). Or, in other words, if it works, great, but if it doesn't work, provide the user an alternate authentication challenge.

The UX problems this presents upon failure are a real issue.

So, is it secure? Technically no because for it to be used as a reliable primary authentication method, it would have to be very permissive to allow for normal variations in human behaviour. But it could be used as an augment to provide a confidence factor for another secure authentication method.

Improve this answer
6
  • 1
    So, yes, DDA mixed with facial recognition is a potential, where DDA adds "confidence" (didn't mean to make a word play there)
    – schroeder ♦
    Mar 31, 2017 at 9:07
  • 1
    Combined with a Kinect, you could build a challenge-response protocol. It would recognize a user's face, then ask them to strike a number of poses. And show today's newspaper. Also works nicely as a CAPTCHA.
    – S.L. Barth is on codidact.com
    Mar 31, 2017 at 13:48
  • 1
    @S.L.Barth I'd pay to watch videos of people logging in with this method...
    – schroeder ♦
    Mar 31, 2017 at 14:30
  • For some people, I'd pay to NOT have to watch it! :-D
    – S.L. Barth is on codidact.com
    Mar 31, 2017 at 14:32
  • Another common problem between biometrics and human behavior authentication is that it's very easy for the performance of the authentication method to change for a long but temporary time or permanently. If I have a cast I might type more slowly or make more mistakes for a few weeks, and if I lose a foot my dancing will never be the same.
    – IllusiveBrian
    Mar 31, 2017 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .