Problems with passwords

Any new web service account usually requires a new complex password. Although password managers help creating and organizing them, many users still choose simple passwords to easily remember them and sometimes even re-use them for different services. Once leaked or guessed, these passwords can become a major threat for private users but also companies due to the recurring identity leaks (see HPI Identity Leak Checker). In this project, we evaluate behavior-based authentication and whether this approach can solve some of these problems.

Behavioral Biometrics

Apart from passwords that are based on knowledge, there also exist possession-based mechanisms (e.g., access cards, keys, usb-tokens) and mechanisms based on something a person is for authentication. These biometric approaches either rely on physiological characteristics such as fingerprint or face geometry or behavioral characteristics like the style of walking or how a person types on a keyboard. One big advantage of biometric approaches is the secret being mostly available all the time as there is nothing that needs to be remembered specifically. In addition, the imitiation of biometrics is typically more different in comparison to passwords that can be guessed or access cards that can be stolen or lost. On the other hand, biometrics usually require some learning phase and data leaks are more dangerous as biometric characteristics can not be renewed that easily (e.g., fingerprints).

Specifically, our research is about the following topics:

• conception and evaluation of new innovative authentication mechanism based on behavior
• evaluation and improvement of already well-researched approaches for real-world usage
• schemes to assess and compare these systems

Management Digitaler Identitäten (german)