Years ago, I read a paper about how mobile devices made it possible to authenticate users without entering a password, simply by relying on behavior, habits, locations. Now, the DoD plans to use such authentication mechanisms for their own network security. However, I haven't seen any apps that use this widely.

I guess I have two questions:

1) Are there any real-world examples of such behavioral/implicit authentication systems that justifies the DoD's faith in using this for parts of their network?

2) If no, then what has prevented them from being more widely used-- is it because human behavior is unpredictable and this leads to false negatives (why not use passwords as a backup)? Or is it because of the privacy implications of such a scheme? Surely, we all hate typing passwords on our phone screens...

  • 1
    Looks like they plan to use it as one factor on a multifactor authentication scheme. That is much different from using it as an authentication scheme. – CristianTM Jun 19 '16 at 22:54
  • True. But, most of the literature uses it in exactly the same way-- *as the first authentication factor *, backing off and requiring passwords in case of any sensitive access requirements or if the identification certainty is below a particular threshold. This is different from "traditional 2FA" where both factors are always used. I'm just surprised that the DoD is the first large-scale adopter of something like this, since I haven't seen it being used anywhere else. – Jedi Jun 19 '16 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.