Passthoughts: User Authentication Using Brainwaves

With the embedding of EEG (electro-encephalography) sensors in wireless headsets and other consumer electronics, authenticating users based on their brainwave signals has become a realistic possibility. We undertake an experimental study of the usability and performance of user authentication using consumer-grade EEG sensor technology. By choosing custom tasks and custom acceptance thresholds for each subject, we can achieve 99% authentication accuracy using single-channel EEG signals, which is on par with previous research employing multi-channel EEG signals using clinical-grade devices.

In addition to the usability improvement offered by the single-channel dry-contact EEG sensor, we also study the usability of different classes of mental tasks. We find that subjects have little difficulty recalling chosen pass-thoughts (e.g., their previously selected song to sing in their mind). They also have different preferences for tasks based on the perceived difficulty and enjoyability of the tasks. These results can inform the design of authentication systems that guide users in choosing tasks that are both usable and secure.


I Think, Therefore I Am: Usability and Security of Authentication Using Brainwaves
J. Chuang, H. Nguyen, C. Wang, B. Johnson
Workshop on Usable Security (USEC'13), Proceedings of the Seventeenth International Conference on Financial Cryptography and Data Security (FC'13), April 2013.

One-Step Two-Factor Authentication with Wearable Bio-Sensors
J. Chuang
Workshop on "Who are you?! Adventures in Authentication" (WAY'14), 10th USENIX Symposium on Usable Privacy and Security (SOUPS'14), July 2014.

My Thoughts are Not Your Thoughts: Robustness of Brainwave Signal Authentication Against Impersonation Attacks
B. Johnson, T. Maillart, J. Chuang
Workshop on Usable Privacy & Security for wearable and domestic ubIquitous DEvices (UPSIDE'14), ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp'14), September 2014.

Media Coverage

This study was reported by over 300 international media outlets, including:


BBC Click: Could passthoughts replace the password?

CalConnect: Brainwaves and Passthoughts

Funding Support

This research was supported in part by the National Science Foundation under award CCF-0424422 (TRUST).