5 ms·

So you let a third party record whatever you're doing for a few seconds for security purposes?! Oh, my. Edit: before you shout "but it's just a signature!" Th

by drblast 11y ago

So you let a third party record whatever you're doing for a few seconds for security purposes?! Oh, my. Edit: before you shout "but it's just a signature!" Think of a large entity with huge resources that goes ahead and creates signatures of an entire catalog of recorded English conversations. Now you upload your signature, and that entity can reconstruct your conversation via a catalog search.

Kenji 11y ago
I reacted like this too. But read the article carefully: To protect your privacy, the app doesn’t upload the audio itself, just the digital signature.
- drblast 11y ago
  Yeah, I get it, but think of the things you can do with that digital signature. Joe and Bob - were they together on Sunday at 2pm? Well let's check the digital audio signatures to see if they match. Or, John just uploaded a signature that matches our samples of "Kill the president." And a few thousand other examples.
  - Kenji 11y ago
    That is a fair point. Especially considering that the recording can be started from the outside by a 3rd party.
  - nathancahill 11y ago
    Not feasible. Digital signatures are a one way operation, like hashes: Let's say the audio signature of "Kill the president" is 9a0c0a6868a2a784059d9a634e4a58c0. "kill the president" in a different tone would be entirely different: ed3e3cd6be6eeb2de9b480e2c9590cc9
    - stephengillie 11y ago
      So you're saying they'll have to have a database of these hashes to match against?
    - _kst_ 11y ago
      The server has to compare the signature of the sound recorded by your computer to the signature of the sound recorded by your phone. The sounds will not be identical, so the signature comparison has to be able to detect whether two sound recordings are sufficiently similar. It can't use, for example, SHA1 hashes for this purpose.
      - bcg1 11y ago
        Couldn't they ignore noise below a certain threshold and create the signature just based off of the "peaks" and "troughs" so they could expect an exact match, and/or hash several samples from the recording in case some portions don't produce an exact match? Seems like there should be a way to this without revealing information about the recorded sound
    - bendykstra 11y ago
      If a slightly different sound resulted in an entirely different signature, the system would be useless for comparing recordings of ambient noise, which will never be identical. You've taken the analogy with hashing too far.
    - wonkaWonka 11y ago
      Eh, these are bound to be more like Shazam guess-that-tune signatures, with behavior wildly more loose than any cryptographic hash like an MD5. Conside that the web browser's desktop/laptop microphone and the cellphone/telephone microphone will probably never produce identical audio samples, if not due to the actual transducers, then simply due to proximity to various ambient audio sources like the user's breathing versus fan motors attached to a laptop shell or desktop case.
  - jerf 11y ago
    It depends on the signature. On the "probably too simple, but..." side, record 8 seconds of audio. Normalize it. Bucket the net volume audio levels across quarter-second intervals. Fuzzy match a bit. If the levels have some change in them, and the changes match, you're in. Virtually no useful information in that signature. By contrast, if you get "clever", and want to go with that basic approach, but you want more bits to fuzzy match, so you break apart the frequency bands into 64 bands and sample on 50 millisecond intervals, and you're getting perilously close to revealing speech in the signature with enough processing. (You lose a lot, but you end up with more to work with than we privacy sensitive folks would like.) The point isn't that either of these are what they are doing. I don't expect either of those would "work" on their own; I kept them simple to describe and simple to understand for the purposes of this post. The point is the info leak on the signature can vary quite widely depending on how they do it, and without knowing the algorithm you can't speculate very effectively. It could be anything from "fairly safe" to "you might as well just send up the audio".
  - kazinator 11y ago
    The solution to these problems is simple. 1. "Joe and Bob - were they together on Sunday at 2pm?" Joe and Bob avoid this by not authenticating using the same mechanism in the same room at the same time. 2. "John just uploaded a signature that matches our samples of 'Kill the president'". Solution 1: John understands how the authentication works by recording ambient sound, and refrains from saying things like "kill the president" during that procedure. Solution 2: John starts an Internet meme which encourages every user of this authentication mechanism to say "Kill the president" over and over again during the procedure. Now, millions of signatures match.
    - task_queue 11y ago
      Most people do not consider the consequences of technology nor how to route their behavior around them.
      - kazinator 11y ago
        People can be told that the authentication method listens to their ambient sounds through their phone and PC at the same time to determine that those two pieces of equipment are in the same location, and that although their privacy is safe-guarded, they shouldn't say anything confidential during this time.
  - Navarr 11y ago
    because you're shouting "kill the president" when you're logging into a website?
- Niten 11y ago
  Regardless of what is actually uploaded, a phone app and website implementing this would need to get microphone permissions from the user, and it would be difficult for the user to verify that raw audio isn't being captured as well. (There's no separate "audio fingerprint" permission.) That could become a barrier to adoption in practice. I'm also not sure how I feel about a second factor that would allow an adversary to authenticate by simply sitting in the same coffee shop as me. Manual authentication seems important, and U2F already addresses some of the nusiances of TOTP-based schemes. This is a really clever innovation, though.
deleted 11y ago
[deleted]
anotherangrydev 11y ago
Well... that third-party already something valuable of you. Your email, bank account, whatever is behind that auth. So, do you trust a third party having that information of you?
- mortenlarsen 11y ago
  They already have some information, so you might as well give them more information? Substitute money for information, and I would love to do business with you. "You are already paying me $20, so you might as well give me $100."
  - anotherangrydev 11y ago
    This is honestly one of the few really good and creative ideas I've seen here in a VERY long time. I really don't mind sharing an audio hash with someone that already has my full banking information/history in there. Not only that, I would be EAGER to do it if that will increase the security of the current contract that I have with them, specially since they found a way to do it that it's not bothersome at all. But yeah, whatever you say naggy HNers.

by drblast 11y ago

Kenji 11y ago

I reacted like this too. But read the article carefully: To protect your privacy, the app doesn’t upload the audio itself, just the digital signature.

drblast 11y ago
Yeah, I get it, but think of the things you can do with that digital signature. Joe and Bob - were they together on Sunday at 2pm? Well let's check the digital audio signatures to see if they match. Or, John just uploaded a signature that matches our samples of "Kill the president." And a few thousand other examples.
- Kenji 11y ago
  That is a fair point. Especially considering that the recording can be started from the outside by a 3rd party.
- nathancahill 11y ago
  Not feasible. Digital signatures are a one way operation, like hashes: Let's say the audio signature of "Kill the president" is 9a0c0a6868a2a784059d9a634e4a58c0. "kill the president" in a different tone would be entirely different: ed3e3cd6be6eeb2de9b480e2c9590cc9
  - stephengillie 11y ago
    So you're saying they'll have to have a database of these hashes to match against?
  - _kst_ 11y ago
    The server has to compare the signature of the sound recorded by your computer to the signature of the sound recorded by your phone. The sounds will not be identical, so the signature comparison has to be able to detect whether two sound recordings are sufficiently similar. It can't use, for example, SHA1 hashes for this purpose.
    - bcg1 11y ago
      Couldn't they ignore noise below a certain threshold and create the signature just based off of the "peaks" and "troughs" so they could expect an exact match, and/or hash several samples from the recording in case some portions don't produce an exact match? Seems like there should be a way to this without revealing information about the recorded sound
  - bendykstra 11y ago
    If a slightly different sound resulted in an entirely different signature, the system would be useless for comparing recordings of ambient noise, which will never be identical. You've taken the analogy with hashing too far.
  - wonkaWonka 11y ago
    Eh, these are bound to be more like Shazam guess-that-tune signatures, with behavior wildly more loose than any cryptographic hash like an MD5. Conside that the web browser's desktop/laptop microphone and the cellphone/telephone microphone will probably never produce identical audio samples, if not due to the actual transducers, then simply due to proximity to various ambient audio sources like the user's breathing versus fan motors attached to a laptop shell or desktop case.
- jerf 11y ago
  It depends on the signature. On the "probably too simple, but..." side, record 8 seconds of audio. Normalize it. Bucket the net volume audio levels across quarter-second intervals. Fuzzy match a bit. If the levels have some change in them, and the changes match, you're in. Virtually no useful information in that signature. By contrast, if you get "clever", and want to go with that basic approach, but you want more bits to fuzzy match, so you break apart the frequency bands into 64 bands and sample on 50 millisecond intervals, and you're getting perilously close to revealing speech in the signature with enough processing. (You lose a lot, but you end up with more to work with than we privacy sensitive folks would like.) The point isn't that either of these are what they are doing. I don't expect either of those would "work" on their own; I kept them simple to describe and simple to understand for the purposes of this post. The point is the info leak on the signature can vary quite widely depending on how they do it, and without knowing the algorithm you can't speculate very effectively. It could be anything from "fairly safe" to "you might as well just send up the audio".
- kazinator 11y ago
  The solution to these problems is simple. 1. "Joe and Bob - were they together on Sunday at 2pm?" Joe and Bob avoid this by not authenticating using the same mechanism in the same room at the same time. 2. "John just uploaded a signature that matches our samples of 'Kill the president'". Solution 1: John understands how the authentication works by recording ambient sound, and refrains from saying things like "kill the president" during that procedure. Solution 2: John starts an Internet meme which encourages every user of this authentication mechanism to say "Kill the president" over and over again during the procedure. Now, millions of signatures match.
  - task_queue 11y ago
    Most people do not consider the consequences of technology nor how to route their behavior around them.
    - kazinator 11y ago
      People can be told that the authentication method listens to their ambient sounds through their phone and PC at the same time to determine that those two pieces of equipment are in the same location, and that although their privacy is safe-guarded, they shouldn't say anything confidential during this time.
- Navarr 11y ago
  because you're shouting "kill the president" when you're logging into a website?
Niten 11y ago
Regardless of what is actually uploaded, a phone app and website implementing this would need to get microphone permissions from the user, and it would be difficult for the user to verify that raw audio isn't being captured as well. (There's no separate "audio fingerprint" permission.) That could become a barrier to adoption in practice. I'm also not sure how I feel about a second factor that would allow an adversary to authenticate by simply sitting in the same coffee shop as me. Manual authentication seems important, and U2F already addresses some of the nusiances of TOTP-based schemes. This is a really clever innovation, though.

deleted 11y ago

[deleted]

anotherangrydev 11y ago

Well... that third-party already something valuable of you. Your email, bank account, whatever is behind that auth. So, do you trust a third party having that information of you?

mortenlarsen 11y ago
They already have some information, so you might as well give them more information? Substitute money for information, and I would love to do business with you. "You are already paying me $20, so you might as well give me $100."
- anotherangrydev 11y ago
  This is honestly one of the few really good and creative ideas I've seen here in a VERY long time. I really don't mind sharing an audio hash with someone that already has my full banking information/history in there. Not only that, I would be EAGER to do it if that will increase the security of the current contract that I have with them, specially since they found a way to do it that it's not bothersome at all. But yeah, whatever you say naggy HNers.