Syllabus Lesson 127 of 156 · Tracking the person, not the device
Tracking the person, not the device

Behavioural biometrics

Why it matters So far in this course, trackers followed a device: a cookie in a browser, a fingerprint of a laptop. This module turns to something harder to change: you. The way you type, move a mouse and scroll can be measured by any page you use, and it travels with you from device to device.

Your hands have habits

Think of how you recognise a friend's knock on the door before they say a word. Nobody taught you their rhythm; you simply heard it many times. Your typing works the same way. You hold some keys a little longer, you pause before awkward letters, and you rush through words you type every day.

Behavioural biometrics: recognising a person from how they do things (type, move, swipe, scroll) rather than from what they are (a fingerprint or a face) or what they know (a password).

A biometric is a measurement of the body. A behavioural biometric measures a habit instead. You cannot leave a habit at home the way you can leave a phone.

What a page can measure

Every time you press or release a key, the page receives an event: a small message saying what happened and exactly when, to a fraction of a millisecond. A script that listens to those events can build up three kinds of timing:

Dwell time: how long one key is held down, from press to release. Typically around a tenth of a second, and different for each finger and each person.

Flight time: the gap between releasing one key and pressing the next. It depends on the pair of letters and on how practised you are at that pair.

  • Typing: dwell and flight times for each key and each pair of keys.
  • Mouse: how curved your path to a button is, how fast you speed up and slow down, whether you overshoot and correct.
  • Touch and scroll: how hard and how fast you swipe, how far each flick travels, how often you scroll back up.

None of this needs a special permission. A script on the page can listen to keys and mouse movement inside that page, so the page's own code and any third-party script it includes can collect it.

Who uses it, and why

Not every use is sneaky. Banks and shops use behavioural signals to spot fraud: if someone logs in with your password but types it in a completely different rhythm, that is a warning sign. Some sites use mouse movement to guess whether a visitor is a person or an automated program.

The privacy problem is the other side of the same coin. A rhythm good enough to recognise you is good enough to follow you. If two sites use the same third-party script, it could notice that the same hands typed on both, even after you cleared cookies, changed browser or switched to a different laptop.

How strong is it?

Typing rhythm on its own is not as precise as a password. It changes when you are tired, cold, injured or on a new keyboard. But trackers rarely use one signal alone. Joined with the device signals from earlier legs, a rhythm narrows the crowd further. In the next lesson you will measure this yourself on 50 made-up typists.

A common misconception

"It only matters if I type something secret." The content does not matter at all here. A script can learn your rhythm from you typing your name, a search term or a comment. It is the timing, not the words, that identifies.

Try it See the timing a page receives, on a blank page so nothing is sent anywhere.

  1. Open a new tab and go to about:blank.
  2. Open the developer tools (F12, or Cmd+Option+I on a Mac) and choose the Console tab.
  3. Paste this line and press Enter: addEventListener('keydown', e => console.log(e.key, e.timeStamp.toFixed(1)))
  4. Click on the page itself (not the console) and type your first name. Each key appears with the time, in milliseconds, at which the page saw it.
  5. Subtract neighbouring times to get your own gaps between keys. Type the name again and compare: the gaps are close, but not identical.

Close the tab when you finish; the listener disappears with it. Nothing you typed left your computer. When this course adds its own live typing box, it works the same way: a set phrase, timings kept in memory only, never sent to the tutor or saved with your progress, and thrown away when you leave the page.

Recap

  • Behavioural biometrics recognise a person from habits: typing rhythm, mouse paths, swipes and scrolling.
  • Any script running in a page can measure key and mouse timings there, with no permission prompt.
  • The same signal helps fraud checks and can also follow you across devices.
  • It is the timing, not what you type, that identifies you.

Spotted a problem in this lesson? Report it

Code · runs in your browser
Output

        

      

      
      

        Back