PASSWORDS ARE TROUBLE, we know this. Users lose them, forget them, choose bad ones, and – as Societe Generale found to its chagrin in January – share them. How can you be sure that the person typing in the password that unlocks the gateway to losing £7 billion in rogue trades is the person who's meant to have that password?

You might say, "Fingerprints?", but Peter Horadan, senior vice president of engineering and client services for Seattle-based Biopassword, points out the flaws in that idea. They have error rates, for one thing, and they can be fooled – as a season four episode of Mythbusters proved. An even bigger problem is that fingerprint readers have to be deployed everywhere. "The hardware breaks," says Horadan, "and people don't like it. Traders might be willing to be fingerprinted, but consumers don't want to be fingerprinted just to get into their online banking account." Plus, if the system gets hacked into, you can't get new fingers.

Biopassword's solution is a system that takes advantage of the fact that no two people type quite the same way. Enrolling in Biopassword's system involves creating a template from five samples, against which future login attempts are tested. The system runs on the owning organisation's server, and the owner can tune how tolerant it should be of imperfect matches. Too perfect, and the system can kick it out as a replay attack; too variant from the template, and the system can reject the user or ask a backup security question. From the user's point of view, very little is different.

Obviously, there are complexities to this. People's timing changes over time, and different keyboards have different technical characteristics to which the system must adapt.

"I think we've achieved some pretty great accuracy here," says Horadan, "but the focus of the last two years has been math. A lot has been invented here through trial and error. We built an engine with a library of tests so you can create a new idea for the math, then push a button and run it through all the test programs and they will show how the idea performed." The company runs internal contests where employees come up with "any crazy idea you can think of. It's almost like genetic selection."

Such brainstorming helped Biopassword's team identify 43 factors that characterise typing patterns and work out an algorithm to compare sets. There were, Horadan says, many design challenges and interesting problems to solve.

"Some typers are more consistent than other typers," he says. "How do you weight for that?" Or, he says, "How do you determine that there are multiple people on an account? We've built clustering algorithms that take the samples provided and find a way to measure the distance between them." Account sharing is an issue in, for example, financial trading, where companies want non-repudiability.

Horadan says his career has always been about "making things easier for people". He spent eight years at Microsoft working on the online banking part of Money. "Instead of having to read paper statements – see them online without doing any work." At BEA, he created Web Logic Workshop to make it easier to write programs for J2EE.

Biopassword grabbed his attention with a demonstration. "It's one of those things that just sells you," he says. "You don't really believe it when you first hear it. It sounds like magic. Then you get a demonstration and you become a believer. It's astonishing how well it works."

The company hired Tolly Group to do an accuracy study. In it, they gave 100 users 100 user names and passwords to type in batches of ten on different workstations. To test for false acceptances, 99 testers try to break into the remaining user's IDs and passwords. To test for false rejections, each user creates a template from his first five samples and then tries to log in with each of the other 95. The study found a 99 percent accuracy on acceptances and 98 percent on rejections.

Horadan believes that making security easier for users is of key importance . "Security is very challenging for users," he says, "carrying tokens, memorising passwords." µ