Simple Keystroke Dynamics (KD) Measurement with JQuery

Question

I want to develop a simple app to measure dwell time and flight time (see http://www.techrepublic.com/article/reduce-multi-factor-authentication-costs-with-behavioral-biometrics/6150761) in a text area / box. how can I use keypress() or keydown() up() methods to record these events?

Answer 1

I believe this approach would not be fruitful in a real-world environment, because whatever processing you do in Javascript is, in line of principle, easily modifiable by the user, by using a simple javascript debugger or programs like Firebug.

That said, you could measure the two metrics in this way:

• dwell time = time between keydown() and keyup(). In your keydown() method save the current time and in the keyup() compute the twell time as the difference between the current time and the keydown() time.
• flight time: from the figure of the article you linked I can't easily understand how it is defined, but I would compute it as the difference between when you left the last key (keyup()) and when you start pressing the next key (keydown()). So in keyup() save a time, for instance last_key_time, and in keydown() compute the flight time as current_time - last_key_time

Answer 2

See an example here: http://jsfiddle.net/VDMPt/ source

But as Andrea said, is not worth it since Javascript is client side

var xTriggered = 0;
$('#target').keyup(function(event) {
  if (event.keyCode == '13') {
     event.preventDefault();
   }
   xTriggered++;
   var msg = 'Handler for .keyup() called ' + xTriggered + ' time(s).';
  $.print(msg, 'html');
  $.print(event);
});

$('#other').click(function() {
  $('#target').keyup();
});

Answer 3

I don't understand why this would not be worth it. Just because Javascript can be modified on the client side does not mean an attacker could reproduce an actual user's typing patterns.

Doing this on the client side has the added benefit of keeping the user's data private (e.g. you're not actually collecting user's keystrokes, but only information related to their typing patterns).

I'm sure there are still privacy concerns, but this is a very interesting authentication (or auditing/detection) control.