Category: User Behavior / Human-Computer Interaction
1. Description
Behavioral biometrics measure how a user interacts with their device. Unlike hardware fingerprints, these are dynamic they vary with mood, context, fatigue, and practice. However, they are also highly individual: keystroke dynamics alone can identify a user with >95% accuracy in controlled settings.
2. Vectors
2.1 Keystroke Dynamics
document.addEventListener('keydown', event => {
console.log({
key: event.key,
timestamp: performance.now(),
code: event.code,
location: event.location
})
})
document.addEventListener('keyup', event => {
console.log({
key: event.key,
timestamp: performance.now(),
holdTime: performance.now() - keydownTime, // Key hold duration
})
})
Measurable characteristics:
- Key hold time: Duration between keydown and keyup (typically 50-150ms)
- Inter-key interval: Time between successive key presses
- Key pressure (on supported devices): Touch pressure for each key
- Error patterns: Backspace usage, correction behavior
- Typing speed: Characters per minute (varies by task)
- Rhythm: Consistent patterns of long/short intervals
Entropy: ~15-25 bits (highly individual)
Stability: Moderate affected by fatigue, emotion, device, keyboard type
2.2 Mouse Movement Patterns
document.addEventListener('mousemove', event => {
console.log({
x: event.clientX,
y: event.clientY,
timestamp: performance.now(),
button: event.buttons,
movementX: event.movementX,
movementY: event.movementY
})
})
Measurable characteristics:
- Trajectory: Path curvature, straightness, overshoot
- Speed-acceleration profile: How speed changes during movement
- Click behavior: Time between mouse-down and mouse-up, position accuracy
- Hover patterns: Where the mouse pauses
- Scroll coupling: Mouse movement during scrolling
Entropy: ~10-20 bits (moderately individual)
Stability: Low-Moderate affected by surface, device, task
2.3 Scroll Patterns
document.addEventListener('scroll', event => {
console.log({
scrollY: window.scrollY,
timestamp: performance.now(),
deltaMode: event.deltaMode,
deltaY: event.deltaY
})
})
Measurable characteristics:
- Scroll speed: Pixels per scroll event
- Acceleration: How scroll speed changes
- Pause frequency: How often scrolling stops
- Rhythm: Regular vs burst scrolling
- Read-then-scroll pattern: Time between stopping scroll and next scroll
Entropy: ~8-12 bits
Stability: Low task-dependent (article vs search results vs social media)
2.4 Touch Gestures (Mobile)
element.addEventListener('touchstart', e => { /* touch start */ })
element.addEventListener('touchmove', e => { /* touch trajectory */ })
element.addEventListener('touchend', e => { /* touch end, speed */ })
Measurable:
- Swipe angle, speed, acceleration
- Tap pressure (on supported devices)
- Pinch-zoom patterns
- Multi-finger coordination
- Touch size (finger contact area)
Entropy: ~12-18 bits
Stability: Moderate affected by device, grip, posture
3. Attacker's Strengths
| Strength | Explanation |
|---|---|
| Highly individual | Keystroke dynamics can identify a user with >95% accuracy |
| Continuous | Not a one-time check ongoing monitoring |
| Hard to mimic | Faking another person's behavior is extremely difficult |
| No permission required | Mouse/keyboard/touch events are readable from JS |
| Passive | User cannot tell they are being measured |
4. Attacker's Weaknesses
| Weakness | Explanation | Exploitable? |
|---|---|---|
| Requires interaction | Cannot fingerprint without user input | Limit interaction |
| High variance | Changes with mood, fatigue, context | Reduce reliability |
| Long collection time | Needs minutes of data for accuracy | Short sessions are safe |
| ML required | Simple hashing doesn't work for behavioral data | No |
| Task-dependent | Not consistent across different websites | Limited correlation |
| Easily disrupted | JS timing interference breaks measurement | Yes |
5. Detection of Tampering
| Technique | How It Works |
|---|---|
| Missing event listeners | No mouse/keyboard events being captured is suspicious |
| Injected noise patterns | Timing data with unusual patterns (too regular, too random) |
| Signal quality | Missing micro-timing features expected from hardware |
6. Mitigations for Obscura
6.1 What Obscura Can Do
| Mitigation | Effectiveness | Detectability | Implementation |
|---|---|---|---|
| Override event listener registration | Low | High | Proxy event handlers |
| Inject timing noise | Low-Medium | Medium | Round event timestamps |
| Block specific event types | Medium | High | Override addEventListener |
6.2 What Obscura Cannot Do
| Cannot | Why |
|---|---|
| Change user behavior | User moves mouse, types, scrolls this is physical |
| Remove keyboard input | Typing is necessary for interaction |
| Normalize mouse patterns | Mouse movement is user-controlled |
| Prevent ML classification | ML can find patterns in noisy data |
6.3 Recommended Approach
1. Round event timestamps to 50ms granularity (reduces timing precision)
2. Accept behavioral biometrics require ML infra (most attackers won't have this)
3. Use Tor Browser for high-sensitivity browsing (Tor disables many events)
Note: Behavioral biometrics are primarily a concern for high-value targets (banking, social media) with significant ML investment. For typical browsing, this vector is rarely exploited.
7. Research References
- Monaco, J. et al. (2018). "Behavioral Biometrics: A Survey." ACM Computing Surveys.
- Teh, P. et al. (2014). "A Survey on Keystroke Dynamics." ACM Computing Surveys.
- Yampolskiy, R. et al. (2011). "Behavioral Biometrics: A Survey and Classification." International Journal of Biometrics.
- Acar, G. et al. (2014). "The Web Never Forgets" mentions behavioral tracking in context of cross-site correlation.