Typeprint analysis is a technology in which the rhythmic patterns of a person's keyboard behavior, known as keystroke dynamics, are analyzed over a period of time and then stored. When used in combination with other data, typeprint analysis can help to positively identify an individual in situations where doubt exists.
A typeprint analysis program is more than a keystroke logger. To develop a typeprint for an individual, a specialized computer program records not only the keystrokes entered but also the timing of entry. With each individual, certain patterns or idiosyncrasies always appear and repeat. These characteristics, having been formed over years or even decades of keyboard use, are unconscious behaviors and are therefore impossible to fake or change. For example, a particular person might habitually type the letter combinations "gh" or "sh," with practically no delay between, while always hesitating within the letter sequences "it" or "ju." While such limited data alone is not sufficient to uniquely identify a person, it can remove doubt in situations where the authenticity of a user is uncertain even when the entered username and password are correct.
Consider a situation in which John Doe's username and password are entered correctly by an impostor into a blog Web site and the system is abused by that person on a continuing basis. The blog facilitator contacts John Doe with incriminating data. John Doe denies having made any of the offending posts. By obtaining typeprints in blog entries made by the guilty party and comparing them with typeprints of John Doe's actual entries or test entries, John will likely be exonerated. In some cases, typeprint analysis of username and password entries alone may be sufficient.
The concept of identification using keystroke dynamics has existed for more than 10 years. Typeprint analysis software is inexpensive, easy to write and easy to implement. The frequency of false acceptance or false rejection, given sufficient input data, is low when typeprint analysis is used in conjunction with at least one other authentication method. However, privacy hawks have raised concerns that individuals' keystroke dynamics might be obtained, collected and stored by corporations, police departments or even hackers without people's knowledge or consent.