7 ms·
What if I have a recording of the account-holder's voice? Could computers be programmed to mimic voices after hearing a sample? What are the fallbacks - presuma
by m0nty 11y ago
What if I have a recording of the account-holder's voice? Could computers be programmed to mimic voices after hearing a sample? What are the fallbacks - presumably old-fashioned verifications which might be subject to social engineering?
- dazc 11y agoA representative has just been interviewed on BBC Radio 2 and she claimed the system can automatically detect if it's a recording.
- dangravell 11y agoIf it was anything like the interview I heard on the Today programme, the representative was claiming a lot of things. My inner cynic couldn't help but wince. That isn't too say it's inferior to other mechanisms though.
- dazc 11y agoProbably the same person but a shorter interview, no specifics were discussed. The answer went unchallenged.
- tamana 11y agoUh huh. What the PR rep says is not what is true.
- neximo4 11y agoI suspect certain types of recording, i.e lossless wouldn't be able to be distinguished. But your typical mp3, voice recording wont make the cut. It's quite easy to tell a recording apart from a spectrogram. There are also ways around this the bank can employ, such as the use of spontaneity, which a recording cannot account for, i.e ask the user to say something random if there is a doubt.
- sjtgraham 11y agoRemember that telephone calls are sampled at 8khz. A lot of information will automatically be lost before the signal reaches the other party.
- martinald 11y agoAgreed, this is the reason I don't really trust the claims here. It's actually much worse if you are using a mobile phone, since the GSM codec will add even more artefacts before being passed via PSTN to them. Add that to serious background noise and you are giving people to fake way more room than a crystal clear PCM WAV.
- trtmrt 11y agoYour voice is already distorted by transfer medium, mobile phones are terrible, something like 4-8khz ...
- tamana 11y agoWe have software that can make a synthetic video of any person mimic another person's movements, in real time. I am sure audio is even easier.
- AnimalMuppet 11y agoWe can put one person's skin and face on another person's motion capture, yes. We can't (as far as I know) make one person appear to have another person's gestures, unless the first person can mimic those movements quite well. There's a lot of nuance in the spoken voice. Don't be sure audio is easier than motion. (Faking it well enough to fool a computer is easier than fooling a human, though...)
- pluma 11y agoObligatory Sneakers reference: https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64
- codeulike 11y agoThe cost of occasional fraud is probably priced in already. Thats how credit cards are handled.
- rwmj 11y agoIn the UK, if you log in to your bank account on the phone, pass the required verification checks, and say you want to transfer all your available funds to your long lost aunt's account in Russia, then your money is transferred, irretrievably. It's going to be up to you to prove that the bank's verification is faulty, so good luck with that.
- jjp 11y agoDepending on the bank the controls vary. For example Natwest require multiple factor to setup the destination bank account the first time you do a transfer and then less authentication on subsequent transfer. Multiple factor because you would need to know my online account number, online pin code, online password be in possession of my bank card, use a Natwest card reader that authenticates me using chip and pin. Yes it's a frustrating way to pay a mate £5 but does make it a lot harder to be attacked.
- alexhawdon 11y agoIn practice, I should imagine fraud protection would kick in and prevent the transaction.
- reitoei 11y agoExactly. A transaction like this would likely trigger multiple risk indicators and require manual intervention by the bank/3rd party before a transfer of this nature would be allowed. Not saying it can't happen, of course, but it shouldn't.
- ZeroGravitas 11y agoI've had several much less dodgy transfers flagged up and recieved phone calls to confirm them. Though, that doesn't answer the question of what happens if they miss one. Could be 0.001% for them, but your whole life savings could be gone.
- DanBC 11y agoThe service could present a phrase for the user to say, which prevents the recorded voice attack.
- rwmj 11y agoAgainst an insufficiently smart attacker. How about a computer that can learn to imitate any speech, perhaps by modelling the shape of the vocal tract (which is how modern speech synthesizers actually work, so it's not a huge leap).
- melling 11y agoShouldn't security be multilayered? if I want to transfer money out of my account or I exceed certain limits then I need additional authentication.
- rwmj 11y agoDefinitely, and the banks do have additional checks. The question is whether voice recognition adds significant burden to attackers. Or more likely, whether banks can claim that voice recognition is bulletproof and could never be subverted.
- melling 11y agoNo one ever claims something can't ever be subverted. Right? Why would you even think that? Fraud is big business. By the way, it looks like they're incorporating TouchId too: http://9to5mac.com/2016/02/19/hsbc-touch-id-voice-recognition/ http://9to5mac.com/2016/02/19/hsbc-touch-id-voice-recognitio...
- hiddencost 11y agoNo, it's not. Modern systems work using "statistical parametric speech synthesis", i.e., they're models trained from data. Someone did a fluffy piece about the vocal tract modeling approach recently, but that approach sounds awful. All of the notable systems in use and all the notable research is not in that direction.