Paul Moore argues that one legitimate reason to disable paste in the password field (despite the downsides) is so that the server can use keystroke dynamics (behavioral biometrics) as a second form of authentication.
- Are there any websites using behavioral biometrics (on the password field specifically) as 2FA in the wild?
- If so, how successful has it been?
- Is there any particular reason to run the keystroke dynamics analysis on the password field specifically, instead of some other text field?