Andy Greenberg, Forbes Staff
Covering the worlds of data security, privacy and hacker culture.
The screen on Apple’s tablets or smartphones can pick up subtle identifying gestures as unique as a signature on a check. So why, when we log into those devices or use them to verify our identity to apps and Web services, do we still have to pretend we’re using a primitive keyboard?
According to a group of researchers at New York University’s Polytechnic Institute, we don’t. For the last few years, they’ve been working on gesture-based systems for logging into those devices and their apps that they hope can abolish cumbersome passwords and make logging in nearly as simple as the finger swipe that unlocks iOS gadgets and far harder to crack than Android’s nine-point pattern authentication. With a multitouch gesture system that captures enough variables unique to users like hand size, finger placement, and speed of movement, they say they’re getting close.
“When you have a touch interface, it’s silly to use a password. If I make a gesture of a certain sort, there should be enough biometric information in that gesture to differentiate me.” says Nasir Memon, director of NYU-Poly’s cybersecurity program. “It may not distinguish me from the all the other seven billion people in the world, but it will identify me, and the chances that you will be able to do it too are very small.”
The group’s latest prototype is modeled on a combination lock. But instead of merely turning the lock to certain numbers, the user first forms the lock with a pinching motion that creates a circle outline. The time-sensitive pattern created by that pinch-circle motion, along with the motion involved in rotating the dial, are complex enough that Memon says a study of about 100 users has shown it can identify users with about 2% false positives and 2% false negatives. “And we think we can still do better,” Memon says.
Here’s a video of that login function in action.
The first hand in the video is that of Napa Sae-Bae, the doctoral student who developed the prototype. The spinning dial represents a successful login. When another user tries to copy the motion, the app spots enough differences to reject her, even though the lock’s “combination” is only one number and the would-be intruder already knows that combination.
Memon admits that the group hasn’t done enough testing to know whether that biometric test can match the security of a well-chosen password. But he suggests that it already matches the security of a poorly-chosen one, and that it could even be combined with “quick and dirty” face recognition from the device’s front-facing camera to make it harder to crack.
The group plans to develop similar gesture logins for Microsoft’s Surface tables. But notably, the group isn’t working on Android. They say they’ve found that devices running Google’s mobile OS don’t yet have touchscreens reliably sensitive enough to capture the detail needed for their tests.
The combination lock model will likely never replace Apple’s initial login–that would require Apple itself integrating the function into iOS. And the gesture-based system is still likely weeks or months away from debuting.
But the pinch-and-rotate dial isn’t Memon’s first attempt at a gesture-based login. Apple’s App Store already offers another of his apps called iSignOn, which uses the motion of a person’s actual written signature to authenticate him or her. After signing the screen with a finger five times, the app can reliably distinguish the speed and pattern of the user from forgers.
Here’s another video that shows how iSignOn works. (It makes more sense when an actual signature is used instead of the print characters the demonstrator writes below.)