Password dummy

but why not go that extra step and monitor keystroke style?
then, if someone else is using the system you have a third defense that kills anything the user is tryiong to do, hopefully while alerting the admin so they can be caught and charged.

the software to monitor keystroke patterns has been around for a long time, and is an unbeatable defense, as every person has a different pattern to how they use the keyboard. the software can be setup to compare pattern to every legal user of the systems, and take appropriate action if it's another employee using the workstation, or if it's someone completely un-authorised.

First, if you have taken even a basic admin or security class you have learned all the problems with passwords. People write them down. People pick their pets or kids or something. People give them out. They can be cracked.

But who do we hear this from the most? The people that want to SELL the latest, greatest, wizbang that will save us all. Tokens, biometrics, all sound like good products but is the data to support the costs unbiased or does it have a vested interest in you going with a system like this?

I have heard so many people that have a solution to sell me, and each one is better than the rest. I know this, because they told me so.

you could actually increaese the db size for it and have people use the keyboard under different conditions so there is a baseline for most situations.

the ideaa behind it is that eveyone will have some keys they are slower in hitting, faster on some, harder on others...
even one handed this basic pattern is still there.

I remember when I was learning computers back in 81-82, typing one handed at 45 words per minute.. programming in r/t in hex. :)
can you guess which keys I am fast at hitting? ~L~
I know that no one solution is perfect, but this one has the potential to keep intrusions down much more than the password model does.

the biggest drawback is that it must be running on every client to work.
( network access denied if it's not running will keep a lot of hack attempts from getting through even if they have broken the other safeguards. )

Security is always a balance between false positives and false negatives. You have to err on the side of locking out an authorized user for obvious reasons.

With typing cadence people will soon learn to sit down and type normally, especially after you tell them that and they still try it one-handed, standing up, in the dark, drinking coffee, with the cat trying to get their attention.

Password programs are becoming more draconian, they already require a mix of upper case, lower case, and numerals. It won't be long before they have to be of the form A9#9#A. Then of course we'll all forget them, especially since they force us to change them every 90 days.

Passwords just can't provide the security we need without overwhelming the security staff with requests for new passwords, a situation which creates quite a risk exposure of its own.

I predict that biometrics will replace them. Voice prints have the problem you already identified. Your retinas can be removed and stolen if this is a James Bond scenario. Personally I think typing cadence is probably the best way to go.

I also feel that the solution of using biometric devices such as keyboards and mice will always be susceptible to things like plastic tape and laminate material. I think that blood samples and DNA would still be hackable but would be extremely HARD.

I wrote my own "password keeper" for my Palm. There are a number of commercial/shareware versions, but none matched the way I work. My program is currently at version 5 and hasn't had any changes in a year - so it's apparently what I wanted ;-)
If you have a Palm, you can download a copy here: http://www.jecarter.com/passbank/files/passbank.prc

John