
A Car’s Computer Can ‘Fingerprint’ You in Minutes Based on How You Drive - jonbaer
https://www.wired.com/2016/05/drive-car-can-id-within-minutes-study-finds/
======
DrScump
<With 90 minutes driving data or monitoring more car components, they could
pick out the correct driver fully 100 percent of the time.>

With 90 minutes of data, they could pick out one driver _out of a sample size
of 15_. How meaningful is that, really?

~~~
bllguo
Not sure it's as trivial as you seem to be implying, but extending this to
more drivers would certainly be a logical next step.

Honestly it seems like everyone reading these kinds of papers/articles does a
ctrl-f "sample size" before anything else. Bit cynical.

~~~
bravura
For good reason.

It's been easy to do face identification for a very small population for a
while. But scaling that to thousands of people has proven quite difficult.

~~~
clort
Its perhaps surprising to those within the tech industry, to find out how fast
progress has been -- as I recently read

[https://www.theguardian.com/technology/2016/may/17/findface-...](https://www.theguardian.com/technology/2016/may/17/findface-
face-recognition-app-end-public-anonymity-vkontakte)

and the HN discussion

[https://news.ycombinator.com/item?id=11712197](https://news.ycombinator.com/item?id=11712197)

------
sandworm101
Talk about doing things the hard way. With 15 people, I'd bet you could
determine the driver simply by the weight sensor in the driver's seat. No need
to do any actual driving. You could probably make some progress with radio
station settings (volume/channel etc) or even how they adjust the
seats/mirrors.

~~~
Retra
Weight is only one dimensional though, so you'll have more collisions. If two
people happen to weigh about the same, then your weight sensor is useless and
your driving analysis is not.

~~~
lorenzhs
It's far from useless, it limits the pool of candidates to two. Far easier to
distinguish two drivers from each other than fifteen.

~~~
manicdee
And the article points out that they can already distinguish drivers with 90%
accuracy based on the throttle sensor alone after 15 minutes of sampling. With
extra sensors or more time, they get much closer to 100%.

So yes, you(s) are all correct. With one sensor you get decent accuracy, with
more you get improved accuracy.

Noting that these are forensic assessments, and thus useless for personalising
car settings when a new driver gets into the vehicle.

------
sverige
The privacy concern is valid. It won't be long before all new cars are sending
data from the sensors to third parties, and it would be unthinkable for the
manufacturers to ask for your consent before collecting that data since
they'll make money off of it.

The article mentions concerns with insurance companies. One I worked for tried
to get customers to agree to having their rates adjusted based on data from
their cars. It was mostly to do with how many miles the customer drove, but I
think there was also an element that looked at speed coupled with GPS data to
determine if they habitually exceeded the speed limit. There was a lot of
pushback from customers and privacy advocates at the time and it didn't really
go anywhere at the time (2007-08 iirc) but since that time I recall hearing of
another company doing just that with some volunteers.

Now imagine the insurer has access to everything on the CAN bus. Your rates
could go up based on taking curves too fast, braking too hard too often, or
following too close.

The law enforcement angle is disturbing too.

Then there's the nightmare of the advertising people getting hold of it,
complete with GPS data. God knows what they'd do with it exactly, but whatever
it is, it will be sleazy and annoying by definition.

Time to include this on the list of things to oppose for privacy's sake.

~~~
Houshalter
I can't see how this is a bad thing at all. Currently rates are set on
arbitrary things that merely correlate with driving skill, like past record,
age, and gender, etc.

I'd love to be rewarded for actually being a good driver. Rather than being
lumped in with bad drivers who have a high chance of being in $50k accidents,
which everyone has to collectively pay for.

Driving is also the leading cause of death of young people, so anything that
encourages people to drive safer is a huge net good for society. What's more
effective, a sticker that says "buckle up" or "drive slower", or knowing that
your insurance company is keeping track of it?

Of course it should be voluntary and opt out. But there could be a huge gain
for people who opt in.

~~~
Retra
>I'd love to be rewarded for actually being a good driver. Rather than being
lumped in with bad drivers who have a high chance of being in $50k accidents,
which everyone has to collectively pay for.

The whole point of insurance is _not_ to lump you into good driver / bad
driver categories. If you make bad drivers consistently pay for accidents,
then you might as well not have insurance at all, and you'll pay perfectly in
direct proportion to the accidents you are involved in.

Insurance adds fuzziness to the otherwise "perfectly rational" outcome because
people that do not behave rationally with respect to accident avoidance and
financial planning will be at a severe survival and status disadvantage to
those who do. It's like putting safeties on guns to prevent careless people
from shooting people or getting shot. It makes the world more forgiving of
individual mistakes at public cost.

~~~
Houshalter
The entire point of insurance is to pay based on _risk_. Someone with a bad
driving record _should, and does_ pay much more for insurance than a normal
person. An old person should and does pay more for health or life insurance. A
wooden house costs more to get fire insured than a brick building.

The point of insurance is not to let bad drivers get away with their bad
driving. It's to make sure you aren't punished for _bad luck_. But if we can
exactly predict the probability you will get in an accident, there is no luck
involved, you are just a bad driver.

~~~
Retra
You already pay based on risk without insurance. You pay insurance to _reduce_
your risk -- to reduce the costs associated with an accident.

------
pessimizer
I'm surprised it took 90 minutes; I'd imagine that it'd only take two or
three. The data is very rich and continuous, and the knowledge is almost
entirely reflexive. I would also think that identifying typists wouldn't take
much longer. Does anybody know of any papers on that? You could pull that off
with javascript.

~~~
tacon
I don't know of any papers, but for verified certificates from Coursera, you
validate your identity via a webcam selfie and typing their one sentence honor
code into an input field.

------
ThomPete
Wouldn't this mean that you could do that too based on mouse movement? I.e.
couldn't you create a security system based on how you use your mouse?

~~~
geggam
Was an Ex Ebay'r founded startup tried to recruit me. The mouse movement was
part of their security product. Not sure what else they were doing or what
happened to them.

------
LeifCarrotson
I suppose it would depend on the driver. I know a few people I could
fingerprint with the lousy IMU built into my ears with no computer analysis -
some go constantly from the white line to the yellow line and back, some don't
realize that the accelerator works at input levels below 10%, some second-
guess the automatic transmission at every shift...but many drive, well,
normally. Regarding the mouse or keyboard inputs discussed in this thread,
there are a few hunt-and-peckers or over-correctors who would similarly be
found. I don't think it's that impressive to get a few drivers out of a
sample, they likely have detectable quirks.

------
AdamTReineke
Direct link to the publication:
[http://www.autosec.org/pubs/fingerprint.pdf](http://www.autosec.org/pubs/fingerprint.pdf)

------
coroutines
So... I'm expecting surveillance like driver fingerprinting + that shit
Progressive is doing with "Snapshot" to be used to really penalize drivers in
the future for the slightest mishap.

I hate driving - especially in California. Automate all the things.

------
JimLaheyMD
"In a study they plan to present at the Privacy Enhancing Technology Symposium
in Germany this July"

How would this enhance privacy? It seems like it would do the opposite?

~~~
recursive
This is exactly the reason they would never consider lock-picking techniques
at lock symposium.

~~~
fryguy
And hacking techniques at a computer security conference.

------
88e282102ae2e5b
I wonder if you could defeat this by using your left foot (assuming the
fingerprinting was done when you used your right foot).

~~~
AuzzieStig
I scratched my head reading this thinking "Why would using the clutch change
things" also made me think of two things, one being that yes i believe that
swapping your primary foot your using would most likely cause different
driving patters much like swapping where your hands are sitting on the
steering wheel would have a similar effect. And two is i wonder if there would
be an improvement in recognition time if the car being tested had a manual
transmission adding common shift patterns to the equation.

------
btbuildem
Good thing self-driving cars are coming, then.

------
King-Aaron
I bet my 40mm Webber can't.

