Submitted by geoffroy_lesage t3_11zcc1a in deeplearning
geoffroy_lesage OP t1_jdbu15i wrote
Reply to comment by the_Wallie in Question for use of ML in adaptive authentication by geoffroy_lesage
Oh my bad, I've just re-written the post for more user-story type explanation...
the_Wallie t1_jdbujh4 wrote
OK I understand the what now, but not the 'why'. If you're processing personal information to recognize users, that requires their consent. If you have their consent, and we're talking about an installed app on an iPhone or Android, why not just use the user ID or device Id as the identifier? No ml required. Are you trying to identify different users of the same device?
geoffroy_lesage OP t1_jdbuonn wrote
Right, yes it will require their consent but this information stays on device since the ML happens on-device as well. The full picture is that I'm trying to make a passwordless experience where the key generated by the ML model is their password and is used to encrypt and decrypt some data on the device as well (: Idk if that makes sense
the_Wallie t1_jdbuwai wrote
Then either make it a 'stay logged in' experience or use bio info (facial recognition, fingerprints), depending on your security requirements.
Custom machine learning models are difficult to maintain and integrate compared to out of the box standard it solution and api integrations with external (ml) services. We should really only apply them when it makes sense (ie when we have an important, complex problem we can't navigate with simple heuristics and a large amount of relevant data).
geoffroy_lesage OP t1_jdbv9zh wrote
I see, I appreciate the advice. That being said, if the use case made sense for it and it is possible to do, how would you do it? Just as a thought experiment. If you had enough data and power
the_Wallie t1_jdbvvue wrote
I would probably ask them the user to draw a particular shape or set of shapes with their finger and record where they start and how they deviate from the perfect lining of that shape, then (using a vector that represents those deviations over time, their speed, the total time to completion and the starting position), build a database to of users and loosely identify a user using a nearest neighbor algo, or using a deep classifier that has the users as its output layer. What's challenging is you need to start building the data before you can apply it to logins, unless you already have a good proxy task in that context of your app that doesn't require logins (or that you can get after authenticating users using different means).
geoffroy_lesage OP t1_jdbw2s7 wrote
Yea no worries, I can authenticate them differently at first and start tracking data for a while before it becomes important to have this key generated.
But this process you are describing is just to identify users individually using a standard test, not to generate a unique key per user... Is there some way I could achieve this? Generating a unique key from a machine learning model?
the_Wallie t1_jdbwjfb wrote
it depends on what your users are doing in your app. Some unique fingerprint has to come from some sort of behavioral or bio data that can reasonably be assumed to uniquely identify a user. Encoding data in some meaningful way (ml or otherwise) can only happen after you choose what you're encoding.
geoffroy_lesage OP t1_jdbwzjj wrote
I'm not quite sure I understand: "Some unique fingerprint has to come from some sort of behavioral or bio data that can reasonably be assumed to uniquely identify a user"
--> you mean to say "you have to get something unique from the user directly"? Because there are many ways to acquire unique things about a user.... how they type words into a keyboard is a very unique one for example, and there are many metrics that can be measured to figure that out...
- Pressure, Duration of press, Duration between presses, Speed
- Accuracy of presses
- use of backspace, use of auto-correct
- use of emojis, punctuation
- length of phrases, length of text, etc
the_Wallie t1_jdd0t7w wrote
I don't think thst it's self-evident that all of those individual behaviors can actually yield a truly unique behavioral pattern per user for each type of app. Maybe when combined, if your app involves a lot of deep user interaction, but since you haven't shared what your app is supposed to actually do, it's impossible to give an informed opinion on your probability of success a priori, so all I can say is I'm skeptical but I wish you good luck building a solution.
geoffroy_lesage OP t1_jde7chs wrote
Fair enough, no there is no deep user interaction with the app it’s just a normal marketplace app, think Amazon app. I’ve just been relying on a bunch of research papers that seem to suggest that each of those data points individually yield unique profiles with high accuracy but I may be misunderstanding them… just a few:
- https://www.sciencedirect.com/science/article/pii/S1877050921015532
- https://www.sciencedirect.com/science/article/pii/S1877050918314996
Viewing a single comment thread. View all comments