Pith. sign in

REVIEW 4 major objections 6 minor 37 references

The House That Knows You: User Authentication Based on IoT Data

T0 review · 4 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A smart home can identify its active user from HTTPS headers alone, the paper argues.

desk verdict A plausible but over-claimed exploratory result: the 0.97 five-user F1 is a post-hoc best case, while the six-user result is the more honest headline. read the letter →

arxiv 1908.00592 v4 pith:42XBYBQI submitted 2019-08-01 cs.CR

Talha Ongun , Oliver Spohngellert , Alina Oprea , Cristina Nita-Rotaru , Mihai Christodorescu , Negin Salajegheh This is my paper · ORCID
classification cs.CR
keywords IoTauthenticationbehavioralsmarthomesecurityHTTPStrafficanalysisensembleclassificationgradientboostingcontinuousnetworkfeatures
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a smart home can authenticate its residents without passwords, biometrics, or decrypted content, just by watching the HTTPS packet headers that IoT devices already emit through the router. It claims that aggregated statistics of those headers over a 25-minute window—which device talks, to which second-level domain, with what packet sizes and timing—carry enough behavioral signal to tell known users apart. On data from a three-week study with ten users and 15 devices, a single Gradient Boosting model reaches 0.80 average F1 for six users, and an ensemble of two Gradient Boosting models, one on device features and one on domain features, reaches 0.86 F1 for six users and 0.97 F1 for five users. The point of the claim is that the resulting continuously computed authentication score could let authorization systems apply risk-based policies instead of rigid one-time login checks.

What carries the argument

The carrying mechanism is the two-model abstaining ensemble. One Gradient Boosting model consumes device-level features—per-device statistics of incoming and outgoing packet sizes, protocol counts, inter-packet timing, and distinct contacted domains—while the other consumes domain-level features computed per second-level destination domain. Both are trained on sliding 25-minute windows advanced minute by minute, and the system outputs a continuous authentication score only when the two models predict the same user; disagreement suppresses the score rather than forcing a low-confidence answer. This agreement gate is what converts two moderate classifiers into a high-confidence authentication oracle, and the abstention rate is the explicit price paid for that confidence.

What would settle it

Re-run the six-user evaluation on traffic from a home where two or more residents are present and active in overlapping sessions, with camera-based ground truth; if the ensemble's F1 falls well below 0.86 when sessions overlap, the single-occupant labeling premise is what carries the result.

Watch

Extended reading notes

Core claim

The central discovery claimed is that user identity is recoverable from the metadata of encrypted IoT traffic in a closed set of known household members. The authors argue that people interact with different devices, contact different external services, and generate different traffic statistics, and that a multi-class classifier can learn these patterns. Their strongest result is the high-confidence ensemble: two Gradient Boosting models trained on disjoint feature sets—420 device-level features and 2910 second-level-domain features—are combined so that an authentication score is emitted only when both models agree on the user. In their evaluation this ensemble attains an F1 score of 0.86 for six users and 0.97 for five users, at the cost of abstaining in 32 of 105 and 16 of 91 sessions respectively.

Load-bearing premise

The load-bearing premise is that each observation window is generated by exactly one known user who is alone in the room and logged the session boundaries; if real smart-home traffic mixes multiple occupants or the labels are noisy, the reported F1 scores will not transfer.

Editorial extensions

If this is right

  • A home router can continuously score who is active without decrypting traffic, using only timing, ports, byte counts, and destination domains.
  • Authorization policies can become risk-based: low-value actions accept a modest score, while financial or account-changing actions demand a higher score or a second factor.
  • Accuracy improves with longer observation windows up to 25 minutes, so the system trades responsiveness for confidence in a tunable way.
  • The abstention mechanism gives upper-layer systems an explicit not-sure signal that can trigger waiting, additional factors, or fallback authentication.
  • Performance depends on the enrolled user set: removing one hard-to-distinguish user lifts the ensemble F1 from 0.86 to 0.97.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural next test is overlapping occupancy: real households rarely have one person at a time, and the paper defers multi-user evaluation; a plausible consequence is that window labels would need to become set-valued or sequence-based.
  • The disagreement between the two models could itself be used as a feature: instead of treating disagreement as abstention, a policy could request an explicit extra factor exactly when device-level and domain-level views conflict.
  • Because domain features encode which services a user invokes, the model may drift as users add or drop skills and streaming services; periodic retraining, which the paper envisions, would need to handle concept drift rather than a static profile.
  • The same header-only pipeline might extend to open-set problems—flagging an unrecognized visitor or a compromised device—by treating low maximum probability as an anomaly rather than forcing a choice among known users.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a behavioral user-authentication method for smart homes that uses only HTTPS packet-header statistics collected from IoT devices at the home router. The authors ran an IRB-approved study in a university IoT lab with ten users over three weeks, retained six users with more than six sessions each, and extracted two disjoint feature sets: device-level features (420) and second-level-domain features (2910), aggregated over sliding time windows. They compare logistic regression, random forest, and gradient boosting, select a 25-minute window, and design a high-confidence ensemble of two gradient-boosting models that emits a score only when the two models agree. The reported results are a six-user ensemble F1 of 0.86 and a five-user ensemble F1 of 0.97 (Section 5.3, Tables 7 and 8), which the paper frames as enabling continuous authentication scores for flexible authorization policies.

Significance. If the reported performance holds under realistic deployment conditions, this would be a useful privacy-preserving behavioral authentication mechanism: it uses only packet headers, keeps training local, requires only a small fixed user set, and produces a continuous confidence score rather than a one-time binary decision. The paper's strengths include a real user study with session-level holdout evaluation, confusion matrices that make per-user behavior visible, and honest reporting of negative results for DNNs and of the single-occupancy limitation. The significance is conditional, however, on resolving three load-bearing issues: the five-user headline is obtained by dropping the hardest user after seeing the results, the F1 is computed only on windows where the two ensemble models agree, and no confidence intervals are reported. The six-user ensemble result (F1 0.86) is more defensible and is the appropriate primary claim.

major comments (4)
  1. [Section 5.3, Table 8; Appendix Table 9; Abstract] The headline five-user F1 of 0.97 is obtained by removing User 6 from the six retained users after observing that User 6 is the hardest user in both Table 7 (ensemble F1 0.60) and Table 6 (gradient-boosting F1 0.51). This is selection on the test data: it reports a maximum over user subsets, not an estimate for an arbitrary five-person household. The abstract and introduction present the five-user number without this caveat. The authors should either make the six-user result the primary claim, pre-specify an inclusion rule for dropping users, or report the distribution of five-user performance over all subsets of the six users.
  2. [Section 5.3, Tables 7 and 8] The ensemble F1 is computed only on windows where the two models agree, and disagreement windows are excluded from the denominator. For five users, only 75 of 91 evaluation units produce a score (82% coverage), and per-user coverage is much lower for Users 1 and 8, each with only 3 agreed units out of 7. If abstention means 'no authentication score' in a continuous authentication system, then the reported F1 does not describe how often a user can actually be authenticated. The paper should report score availability per user, present the F1 with abstentions counted as failures or as a separate coverage metric, and discuss the operational trade-off between confidence and availability.
  3. [Section 5, Figure 6; Section 5.2] The 25-minute window is selected from Figure 6 on the same evaluation data, and hyperparameters are chosen on the same folds, but no confidence intervals are given and the effective sample size is at most the number of sessions (roughly 91 for five users), not the much larger number of sliding windows generated from those sessions. The reported point estimates are therefore hard to interpret. The authors should use nested cross-validation for model selection or otherwise quantify uncertainty at the session level, for example with bootstrap confidence intervals.
  4. [Section 4.1; Section 7] The labeling procedure requires that exactly one known user is alone in the room and self-reports session boundaries, and the paper defers multi-occupant evaluation to future work in Section 7. This is a stated limitation, but it is load-bearing for the claimed deployment setting: real smart-home traffic often mixes multiple occupants, and noisy labels would directly affect both training and the interpretation of the authentication score. The manuscript should either restrict the contribution to single-occupancy sessions or provide a concrete plan and preliminary analysis for mixed-occupancy traffic before claiming support for general smart-home deployment.
minor comments (6)
  1. [Abstract; Section 1] The abstract says 'classify five users with 0.97 accuracy' while the introduction says 'an F1 score of 0.97'; please use one metric consistently and define it.
  2. [Section 1; Section 4.1] The introduction refers to 'HTTP headers' while Section 4.1 says 'HTTPS packet headers'; since the protocol choice is privacy-relevant, use HTTPS consistently.
  3. [Tables 7 and 8] The columns 'Disagreed' and 'Agreed' are not defined in the captions. State whether the counts are sessions, windows, or something else, and specify that precision/recall/F1 are computed only on the agreed subset.
  4. [Figure 6] The y-axis is labeled 'Accuracy' but the curves are average recall, precision, and F1; relabel the axis to match the plotted quantities.
  5. [Section 5.1] The sentence 'We thus select a time window of 25 minutes for the rest of our experiments' should note explicitly that this choice is based on the same evaluation folds, since the paper does not use a separate validation set.
  6. [Section 4.1, Table 4] The table lists all ten users, but the paper then restricts to six; please state the exclusion rule ('more than 6 sessions') in the table caption or before the table is introduced.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper reports empirical cross-validated classification results, and the five-user statistic is a disclosed conditional evaluation rather than a derivation equivalent to its inputs.

full rationale

The paper makes no formal derivation from first principles; its central claim is an empirical machine-learning evaluation. The six-user F1 of 0.86 is obtained through session-level 7-fold cross-validation on held-out sessions, and no fitted parameter is renamed as a prediction. The five-user F1 of 0.97 is explicitly conditional on two disclosed choices: removing User 6, who is shown in Table 7 to be the hardest user, and requiring ensemble agreement, with 16 of 91 sessions excluded. These choices are a statistical validity concern—they make the five-user number a post-hoc selected statistic rather than an estimate for an arbitrary household—but they do not reduce the result to its inputs by construction. The six-user result and the session-level holdout provide independent empirical grounding. There is no load-bearing self-citation: the cited related work is external, and the Mon(IOT)r Lab acknowledgment is infrastructure support, not an argumentative premise. Consequently, no circular step meets the evidentiary bar of the review rules.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central result rests on clean single-user session labels, on the sufficiency of HTTPS header aggregates as a behavioral signal, and on model-selection choices (window length, hyperparameters, user subset). None of these are derived from theory; they are empirical choices made on the collected dataset. There are no invented physical entities. The main invisible supports are the single-occupancy ground truth and the absence of any baseline for contextual confounds such as time of day.

free parameters (4)
  • Time window length Delta = 25 minutes
    Selected after comparing 5, 10, 15, 20, 25, and 30 minutes in Figure 6; all headline results use 25 minutes.
  • Gradient boosting hyperparameters = 2000 estimators, learning rate 0.01, max depth 3
    Tuned on the collected data; no separate validation set is described.
  • Random forest estimator count = 2000 estimators
    Hyperparameter selection reported in Section 5.2 on the same dataset used for final evaluation.
  • User subset = 6 users (1, 3, 4, 6, 8, 10); 5-user variant removes User 6
    Users with fewer than 6 sessions are excluded, and the five-user headline drops the lowest-performing user, a post-hoc data selection.
assumptions (5)
  • domain assumption Users were alone in the room during each session, and their self-reported session start and end times are accurate ground truth.
    Section 4.1 requires single-occupant sessions for labeling; if this fails, window labels are wrong.
  • domain assumption Aggregated HTTPS header statistics carry enough information to distinguish users.
    The feature design in Section 3.4 assumes device- and domain-level packet statistics reflect user-specific behavior.
  • domain assumption User behavior is stable across sessions.
    Section 4.2 shows some across-session variability, and the classifier's success depends on between-session consistency; the paper does not model drift.
  • domain assumption No adversary is present during training.
    Section 2.3 explicitly assumes training-time attacks are out of scope, so poisoning of user profiles is excluded from the claimed security properties.
  • standard math Session-level cross-validation treats sessions from the same user as independent samples.
    The 7-fold split in Section 5.1 holds out whole sessions, which is reasonable, but within-session sliding windows are highly correlated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The House That Knows You: User Authentication Based on IoT Data." pith.science (2026). https://pith.science/paper/42XBYBQI

@misc{pith2026190800592,
  author       = {Pith},
  title        = {Pith review of: The House That Knows You: User Authentication Based on IoT Data},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/42XBYBQI}},
  note         = {Machine review of arXiv:1908.00592}
}
read the original abstract

Home-based Internet of Things (IoT) devices have gained in popularity and many households have become 'smart' by using devices such as smart sensors, locks, and voice-based assistants. Traditional authentication methods such as passwords, biometrics or multi-factor (using SMS or email) are either not applicable in the smart home setting, or they are inconvenient as they break the natural flow of interaction with these devices. Voice-based biometrics are limited due to safety and privacy concerns. Given the limitations of existing authentication techniques, we explore new opportunities for user authentication in smart home environments. Specifically, we design a novel authentication method based on behavioral features extracted from user interactions with IoT devices. We perform an IRB-approved user study in the IoT lab at our university over a period of three weeks. We collect network traffic from multiple users interacting with 15 IoT devices in our lab and extract a large number of features to capture user activity. We experiment with multiple classification algorithms and also design an ensemble classifier with two models using disjoint set of features. We demonstrate that our ensemble model can classify five users with 0.97 accuracy. The behavioral authentication modules could help address the new challenges emerging with smart home ecosystems and they open up the possibility of creating flexible policies for authorization and access control.

Figures

Figures reproduced from arXiv: 1908.00592 by the authors.

Figure 1
Figure 1. Architecture diagram of the data-flow and proposed authentication process [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Device usage statistics during the user study. [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Domain usage statistics during the user study. [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Total amount of data transmitted by five devices for User 6 in three sessions. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Total amount of data transmitted by five devices for User 10 in three sessions. [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Accuracy metrics for different time windows for 6 users using different [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: User-level ROC curves for 25 minute time windows for three models with 6 users. [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Model ROC curves for 25-minute windows, 6 [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: User-level ROC curves for 25 minute time windows for three models with 5 users. [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]
Figure 10
Figure 10. Figure 10: Averaged ROC curves for 25 minute time windows for 5 users. [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 31 canonical work pages

  1. [1]

    Facebook Stored Hundreds of Millions of User Pass- words in Plain Text

    2019. Facebook Stored Hundreds of Millions of User Pass- words in Plain Text. https://krebsonsecurity.com/2019/03/ facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/

    work page 2019

  2. [2]

    Manage Alexa Voice Purchasing Settings

    2019. Manage Alexa Voice Purchasing Settings. https://www.amazon. com/gp/help/customer/display.html?nodeId=201952610

    work page 2019

  3. [3]

    Passwords, passwords everywhere

    2019. Passwords, passwords everywhere. https://www.ncsc.gov.uk/ blog-post/passwords-passwords-everywhere

    work page 2019

  4. [4]

    Furkan Alaca and P. C. van Oorschot. 2016. Device Fingerprinting for Augmenting Web Authentication: Classification and Analysis of Methods. In Proceedings of the 32Nd Annual Conference on Computer Security Applications (ACSAC ’16). ACM, New York, NY, USA, 289–301. https://doi.org/10.1145/2991079.2991091

    arXiv 2016

  5. [5]

    Noah Apthorpe, Dillon Reisman, Srikanth Sundaresan, Arvind Narayanan, and Nick Feamster. 2017. Spying on the smart home: Privacy attacks and defenses on encrypted IoT traffic. arXiv preprint arXiv:1708.05044 (2017)

    arXiv 2017

  6. [6]

    Battista Biggio, Blaine Nelson, and Pavel Laskov. 2012. Poisoning attacks against support vector machines. In ICML

    work page 2012

  7. [7]

    Chen, Juan Tapiador, and Pedro Peris-Lopez

    Jorge Blasco, Thomas M. Chen, Juan Tapiador, and Pedro Peris-Lopez

    work page

  8. [8]

    Berkay Celik, Patrick McDaniel, and Gang Tan

    Z. Berkay Celik, Patrick McDaniel, and Gang Tan. 2018. Soteria: Automated IoT Safety and Security Analysis. In 2018 USENIX Annual Technical Conference (USENIX ATC 18). USENIX Association, Boston, MA, 147–158. https://www.usenix.org/conference/atc18/presentation/ celik

    work page 2018

Show all 37 references
  1. [9]

    Berkay Celik, Gang Tan, and Patrick D

    Z. Berkay Celik, Gang Tan, and Patrick D. McDaniel. 2019. IoT- Guard: Dynamic Enforcement of Security and Safety Policy in Commodity IoT. In 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, Feb- ruary 24-27, 2019 . https://w...

    2019

  2. [10]

    Emiliano De Cristofaro, Honglu Du, Julien Freudiger, and Greg Norcie

  3. [11]

    David Freeman, Sakshi Jain, Markus Dürmuth, Battista Biggio, and Giorgio Giacinto. 2016. Who Are You? A Statistical Approach to Measuring User Authenticity.. In NDSS. 1–15

    2016

  4. [12]

    Davrondzhon Gafurov, Kirsi Helkala, and Torkjel Søndrol. 2006. Bio- metric Gait Authentication Using Accelerometer Senso.JCP 1, 7 (2006), 51–59

    2006

  5. [13]

    Hana Habib, Pardis Emami Naeini, Summer Devlin, Maggie Oates, Chelse Swoopes, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor

  6. [14]

    Weijia He, Maximilian Golla, Roshni Padhi, Jordan Ofek, Markus Dür- muth, Earlence Fernandes, and Blase Ur. 2018. Rethinking Access Control and Authentication for the Home Internet of Things (IoT). In 27th USENIX Security Symposium (USENIX Security 18). USENIX Asso- ciation, B...

    2018

  7. [15]

    Morley Mao, and Atul Prakash

    Yunhan Jack Jia, Qi Alfred Chen, Shiqi Wang, Amir Rahmati, Earlence Fernandes, Z. Morley Mao, and Atul Prakash. 2017. ContexIoT: To- wards Providing Contextual Integrity to Appified IoT Platforms. In 21st Network and Distributed Security Symposium

    2017

  8. [16]

    Hassan Khan, Aaron Atwater, and Urs Hengartner. 2014. A Compar- ative Evaluation of Implicit Authentication Schemes. In Research in Attacks, Intrusions and Defenses, Angelos Stavrou, Herbert Bos, and Georgios Portokalidis (Eds.). Springer International Publishing, Cham, 255–275

    2014

  9. [17]

    Hassan Khan, Aaron Atwater, and Urs Hengartner. 2014. Itus: An Implicit Authentication Framework for Android. In Proceedings of the 20th Annual International Conference on Mobile Computing and Networking (MobiCom ’14). ACM, New York, NY, USA, 507–518. https: //doi.org/10.1145/...

    2014

  10. [18]

    Shrirang Mare, Andrés Molina Markham, Cory Cornelius, Ronald Pe- terson, and David Kotz. 2014. ZEBRA: Zero-Effort Bilateral Recurring Authentication. In Proceedings of the 2014 IEEE Symposium on Security and Privacy (SP ’14). IEEE Computer Society, Washington, DC, USA, 705–720...

    2014 doi

  11. [19]

    Segreti, Pranshu Kalvani, Richard Shay, Blase Ur, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Michelle L

    William Melicher, Darya Kurilova, Sean M. Segreti, Pranshu Kalvani, Richard Shay, Blase Ur, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Michelle L. Mazurek. 2016. Usability and Security of Text Passwords on Mobile Devices. In Proceedings of the 2016 CHI Conference o...

    2016

  12. [20]

    Wong, Steven Furnell, and Jianying Zhou

    Weizhi Meng, Duncan S. Wong, Steven Furnell, and Jianying Zhou

  13. [21]

    Pardis Emami Naeini, Sruti Bhagavatula, Hana Habib, Martin Degeling, Lujo Bauer, Lorrie Faith Cranor, and Norman Sadeh. 2017. Privacy Expectations and Preferences in an IoT World. InThirteenth Symposium on Usable Privacy and Security (SOUPS 2017) . USENIX Association, Santa Cl...

    2017

  14. [22]

    Ge Peng, Gang Zhou, David T Nguyen, Xin Qi, Qing Yang, and Shuangquan Wang. 2017. Continuous authentication with touch behavioral biometrics and voice on wearable glasses. IEEE Transac- tions on Human-Machine Systems 47, 3 (2017), 404–416

    2017

  15. [23]

    Oriana Riva, Chuan Qin, Karin Strauss, and Dimitrios Lymberopoulos

  16. [24]

    Cong Shi, Jian Liu, Hongbo Liu, and Yingying Chen. 2017. Smart user authentication through actuation of daily activities leveraging WiFi- enabled IoT. In Proceedings of the 18th ACM International Symposium on Mobile Ad Hoc Networking and Computing. ACM, 5

    2017

  17. [25]

    Elaine Shi, Yuan Niu, Markus Jakobsson, and Richard Chow. 2010. Implicit authentication through learning user behavior. InInternational Conference on Information Security. Springer, 99–113

    2010

  18. [26]

    Hossein Siadati, Toan Nguyen, Payas Gupta, Markus Jakobsson, and Nasir Memon. 2017. Mind your SMSes: Mitigating social engineering in second factor authentication. Computers & Security 65 (2017), 14–28

    2017

  19. [27]

    Jacob Steinhardt, Pang Wei Koh, and Percy Liang. 2017. Certified Defenses for Data Poisoning Attacks. InAdvances in Neural Information Processing Systems (NIPS)

    2017

  20. [28]

    Yuan Tian, Nan Zhang, Yueh-Hsun Lin, XiaoFeng Wang, Blase Ur, Xianzheng Guo, and Patrick Tague. 2017. SmartAuth: User-Centered Authorization for the Internet of Things. In 26th USENIX Security Symposium (USENIX Security 17) . USENIX Association, Vancouver, BC, 361–378. https:/...

    2017

  21. [29]

    Segreti, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor

    Blase Ur, Jonathan Bees, Sean M. Segreti, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2016. Do Users’ Perceptions of Password Security Match Reality?. In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems (CHI ’16). ACM, New York, NY, USA, ...

    2016

  22. [30]

    James Wayman, Anil Jain, Davide Maltoni, and Dario Maio. 2005. An introduction to biometric authentication systems. In Biometric Systems. Springer, 1–20

    2005

  23. [31]

    Flynn Wolf, Ravi Kuber, and Adam J Aviv. 2019. Pretty Close to a Must- Have: Balancing Usability Desire and Security Concern in Biometric Adoption. In Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems. ACM, 151

    2019

  24. [32]

    Huang Xiao, Battista Biggio, Gavin Brown, Giorgio Fumera, Claudia Eckert, and Fabio Roli. 2015. Is feature selection secure against training data poisoning?. In Proc. 32nd International Conference on Machine Learning (ICML), Vol. 37. 1689–1698. A APPENDIX We show here addition...

    2015

  25. [2012]

    In USENIX Security Symposium

    Progressive Authentication: Deciding When to Authenticate on Mobile Phones.. In USENIX Security Symposium. 301–316

  26. [2013]

    arXiv preprint arXiv:1309.5344 (2013)

    A comparative usability study of two-factor authentication. arXiv preprint arXiv:1309.5344 (2013)

    2013 arXiv

  27. [2015]

    IEEE Communications Surveys and Tutorials 17, 3 (2015), 1268–1293

    Surveying the Development of Biometric User Authentication on Mobile Phones. IEEE Communications Surveys and Tutorials 17, 3 (2015), 1268–1293. https://doi.org/10.1109/COMST.2014.2386915

    2015

  28. [2016]

    ACM Comput

    A Survey of Wearable Biometric Recognition Systems. ACM Comput. Surv. 49, 3, Article 43 (Sept. 2016), 35 pages. https://doi.org/ 10.1145/2968215

    2016 doi

  29. [2018]

    In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018)

    User Behaviors and Attitudes Under Password Expiration Poli- cies. In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018). USENIX Association, Baltimore, MD, 13–30. https://www. usenix.org/conference/soups2018/presentation/habib-password

    2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.