Next time you enter a username and password, think about the rhythm of your typing.
Not only can it be used to identify you, it can reveal if you are in a stressful environment.

The team behind the discovery suggest it could be used by retailers or banks to detect whether you are logging into your account under extreme stress or duress.

It has long been known that the rhythms of a person's typing style are stable over time, leading to suggestions they could be used to verify identity or even spot early signs of Alzheimer's disease. But little was know about the effect of stress on typing patterns, so psychologist Mike Dowman and colleagues at the University of Abertay, UK, investigated.

Stress test
They asked 35 people to log into a computer 36 times over three separate sessions up to a month apart, using the same user name (abertayexperiment) and password (understandsomething). People were put into stressed and neutral states alternately by listening to a range of sounds known to elicit particular emotions and heard either heard gentle paper crumpling or arguing couples and emergency sirens.

The length of time each key was held down and the interval between one being released and another pressed was recorded to generate a typing "fingerprint" for each person. Electrodes were attached to the typists' hands to detect sweating – a sign of stress also exploited by lie detectors.

The team used the data to develop and test software that identifies a person from their typing style alone. Using just the 36 characters of the login details it was able to correctly identify users 97.2 per cent of the time in a total of 42,840 login attempts. It wasn't unusual for a person's timing to vary by just 20 milliseconds between two logins a week apart, says Dowman.

The data also showed that stress can be detected in a person's typing because it changes the pattern of timings – for example by making key-presses shorter on average – although typists retained enough of their style to be identifiable.

"There's no question: people do type differently under stress," says Dowman. He suggests that security systems could be designed to raise the alarm if it seems that a person might be being forced to log into a system, whether a cash machine or online account. More research will be needed, however, before a system could tell if a person is, say, just having a bad day or being held at gunpoint.

No more passwords
Neil Barrett, a computer security consultant and visiting professor at the Centre for Forensic Computing and Security at Cranfield University, UK, says that the Abertay system's success rate is similar to other biometric systems in use, such as voiceprints or the fingerprint scanners built into laptops.

With further improvements to typing-style recognition, passwords may no longer be needed for some systems, he says. "You can take the identification characteristics of the way they type in their username."

The Abertay group have received patents on their ideas about detecting signs of a stressful environment in a person's typing style.