Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Today, Stack Overflow released their April Fool's joke (a day early, but hey) involving Dance Dance Authentication.
Essentially, it's logging you in by dancing in front of your PC, and it can recognize multiple dance styles. The video is worth a watch, because it's hard to explain how this works.
Now, obviously, this is a joke, but could this actually somehow be made to work as a way to log in? And could this ever be secure?
Any analysis of a human's behaviour has the potential to be used as a form of authentication (keystroke analysis), but there are problems if you attempt to make it a primary authentication factor.
It is far better to use biometric characteristics instead of behaviour as there is less chance for change from attempt to attempt in normal operation. Fingerprints don't change throughout the day, but your enthusiasm while dancing (or typing) can wax and wane depending on your coffee intake.
At best, it might be possible to use behavioural analysis as a "confidence factor" where, if successful, could be used as a part of a second factor for authentication, but failure could not be regarded as a login attempt failure (i.e. not a login failure). Or, in other words, if it works, great, but if it doesn't work, provide the user an alternate authentication challenge.
The UX problems this presents upon failure are a real issue.
So, is it secure? Technically no because for it to be used as a reliable primary authentication method, it would have to be very permissive to allow for normal variations in human behaviour. But it could be used as an augment to provide a confidence factor for another secure authentication method.
