14

Today, Stack Overflow released their April Fool's joke (a day early, but hey) involving Dance Dance Authentication.

Essentially, it's logging you in by dancing in front of your PC, and it can recognize multiple dance styles. The video is worth a watch, because it's hard to explain how this works.

Now, obviously, this is a joke, but could this actually somehow be made to work as a way to log in? And could this ever be secure?

  • 1
    Related if not duplicate security.stackexchange.com/q/155367/86652 – techraf Mar 31 '17 at 8:38
  • 2
    It's a form of behavioural analytics. Similar processes have been legitimately studied for keystroke analysis (timing and speed between various keys used when typing a password). – schroeder Mar 31 '17 at 8:56
  • 1
    @schroeder A Dance Dance authentication could combine behavioural analysis with realtime face recognition. – S.L. Barth Mar 31 '17 at 8:58
8

Any analysis of a human's behaviour has the potential to be used as a form of authentication (keystroke analysis), but there are problems if you attempt to make it a primary authentication factor.

It is far better to use biometric characteristics instead of behaviour as there is less chance for change from attempt to attempt in normal operation. Fingerprints don't change throughout the day, but your enthusiasm while dancing (or typing) can wax and wane depending on your coffee intake.

At best, it might be possible to use behavioural analysis as a "confidence factor" where, if successful, could be used as a part of a second factor for authentication, but failure could not be regarded as a login attempt failure (i.e. not a login failure). Or, in other words, if it works, great, but if it doesn't work, provide the user an alternate authentication challenge.

The UX problems this presents upon failure are a real issue.

So, is it secure? Technically no because for it to be used as a reliable primary authentication method, it would have to be very permissive to allow for normal variations in human behaviour. But it could be used as an augment to provide a confidence factor for another secure authentication method.

  • 1
    So, yes, DDA mixed with facial recognition is a potential, where DDA adds "confidence" (didn't mean to make a word play there) – schroeder Mar 31 '17 at 9:07
  • 1
    Combined with a Kinect, you could build a challenge-response protocol. It would recognize a user's face, then ask them to strike a number of poses. And show today's newspaper. Also works nicely as a CAPTCHA. – S.L. Barth Mar 31 '17 at 13:48
  • 1
    @S.L.Barth I'd pay to watch videos of people logging in with this method... – schroeder Mar 31 '17 at 14:30
  • For some people, I'd pay to NOT have to watch it! :-D – S.L. Barth Mar 31 '17 at 14:32
  • Another common problem between biometrics and human behavior authentication is that it's very easy for the performance of the authentication method to change for a long but temporary time or permanently. If I have a cast I might type more slowly or make more mistakes for a few weeks, and if I lose a foot my dancing will never be the same. – IllusiveBrian Mar 31 '17 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.