In an example computer-implemented method, a number of cursor locations within a text field, and associated action types and time stamps are received via a processor. One or more features including a latency between a number of events associated with the cursor locations is extracted via the processor based on the cursor locations and the associated action types and time stamps. A user is authenticated, identified, or verified via the processor based on the extracted one or more features and a learning model or a statistical mechanism.