добавление
надо сделать именно контроль доступа пользователей

This method will almost certainly produce too many false positives (if the attacker already knows the password and login). Advertising this method as a method for increasing the barrier for attackers will thus produce a false sense of security, which is almost worse that bad security.
Secondly there will be many false negatives, which severely hurts the work flow and usability of the application. Especially because the method is not easily graspable by the average non-technical person, and even if he knows about the method it is probably hard to type in a way that the system will recognize as legal. This of course highly depends on the concrete implementation.

+ ещё одно дополнение это десктопное приложение (не веб)

например, програма по типу PGP
может еще какая-нить БД с контролем доступа.

spec, офф топ: можешь объяснить мне как-нибудь алгоритмы определения клавиатурного почерка?