Contributions to empirical analysis of keystroke dynamics in passwords

• Keystroke pattern stabilization strongly affects verification performance.
• Each sequence of symbols induces a rhythmic profile.
• Rhythm stabilization seems to be a learning/forgetting process.
• Enrollment with post-habituation samples improves verification rates.
• EER is consistently lowered as the number of strokes increases.

Rhythmic patterns in passwords are addressed through biometric verification tests. Experimental results are obtained through three publicly available databases, whereas experiments are guided by questions Q1: How does a subject develop a stable rhythmic signature associated to a new password? and Q2: How does the number of symbols affect biometric performance? Measurements show that even if subjects are instructed to train themselves before sample acquisition, a clear habituation phenomenon is noticed at the beginning of the first sessions, both for the password .tie5Roanl and the passphrase greyc laboratory, with significant consequences in terms of biometric verification performances. As for Q2, all experiments show that error rates are consistently lowered as password length increases. Additionally, a marginal but potentially useful observation is the stabilization of patterns around a rhythmic profile which seems to be induced by the corresponding sequence of symbols, whose consequences are addressed.