TapSongs: Tapping Rythm-Based Passwords

The TapSongs paper was published by a single researcher, Jacob Wobbrock. In in, he introduces a new authentication method based on tapping a tune on a sensor. He points out that this method is (surprisingly) quite secure for three main reasons:

• A TapSong may be entered out of view, preventing "shoulder surfing"
• Even if a TapSong is captured, it may be hard to represent
• Unlike entering a stolen password, which is trivial, entering a stolen TapSong will often fail, because of individual rhythm differences

The third point is especially interesting, because people are quite successful in entering their own TapSongs after only a few entries for training purposes. TapSongs do allow for some deviation due to human timing inaccuracies, and stretches or compresses the entered password to match the length of the correct one stored before checking it.

After developing his tool, Wobbrock was able to test it on 10 subjects. Each of them were given a famous tune to tap 12 times to create a TapSong timing model. They were then asked to log in 25 times. The subjects were able to successfully reproduce the TapSong 83.2% of the time. Subjects then eavesdropped on someone entering each of the famous tunes and were asked to replicate them. They were only successful 10.7% of the time. Even when they were told what the famous tunes were, they were only able to log in 19.4% of the time.

As far as my thoughts go, I would like to first point out a flaw I have seen in several of these papers. Almost all of the user studies are incredibly small. I just don't feel that 10 people can provide enough data to make statistically significant conclusions. With this paper in particular, I feel that this method is actually far less secure than a regular password. In real life, people would probably pick common tunes and would enter the TapSong in the open where it could be easily picked up. Trying to memorize keys that someone is pressing is one thing, but songs are easy to remember. I feel that a musically-minded person could increase their odds from 19.4%, if only by trying the song multiple times.