UC Berkeley School of Information researchers propose a science fiction-style replacement to passwords-- "brainwave-based computer authentication," where one thinks about a password instead of actually typing it.
The idea is actually not too new. It involves the use of electroencephalograms (EEGs) to measure the brainwaves, with "pass-thoughts" replacing typed passwords. However, until recently, EEG technology required dense electrode arrays, proving to be decidedly excessive just to check one's emails...
The UC Berkely system, as presented at the 2013 Workshop on Usable Security, uses the consumer-grade Neurosky MindSet. A Bluetooth headset with a single dry-contact sensor, the MindSet provides a single channel EEG signal from the brain's left frontal lobe. It also proves to be secure, accurate and reproducible enough for password use, so long users want to use it, of course.
After customising tasks and authentication thresholds for each user, the team reduced error rates to below 1%, comparable to the accuracy of multi-channel EEG signals. The pass-thought itself involves thinking on a secret yet uncomplicated task, such as counting objects of a specific colour, imagining singing a song or focusing on one's breahing.
"We find that brainwave signals, even those collected using low-cost non-intrusive EEG sensors in everyday settings, can be used to authenticate users with high degrees of accuracy," the researchers say, before predicting brainwave-based authentication might just be the future of cheap and accessible authentication.
A replacement to the humble password has been a long time coming. Google is looking into authentication via USB devices, while Lenovo, PayPal and 4 other companies launched the FIDO Alliance with the same aim earlier this year.
