3 ms·

Intelligence agencies would be interested in this but they probably have something like it already. Specifically this is relevant for ZRTP protocol. There is a

by rdtsc 10y ago

Intelligence agencies would be interested in this but they probably have something like it already. Specifically this is relevant for ZRTP protocol. There is a voice-based verification step which relies on knowing and recognizing the other party's voice and then verifying a short authentication string they see on their screen. Being able to mimic can lead to ability to conduct a man-in-the-middle attack. To counter-act the strategy is to use dictionary words instead of just numbers for verification, say "pink salad elephant" instead of "1934" so then parties would maybe have a joke or say something referring to the ridiculous word combination combination. That would be harder to mimic.

jameshart 10y ago
This is literally the plot of Sneakers, the 1992 hacking movie. I would hope voice signature systems are beyond "Hi, my name is Werner Brandes. My voice is my passport. Verify Me."
- amyjess 10y ago
  ...and now I realize that the voice print part of Uplink was a reference to a movie.
- rdtsc 10y ago
  Ha, good point. I forgot about Sneakers. This is a bit different though. The idea is that both parties should see the same authentication string and then verify verbally what that is. Say they see "123" so Alice say "I have 123 as my SAS code, what do you have?". And "Bob says, yap I have 123 as well". If Eve is in the middle then she would show "123" to Alice but maybe "456" to Bob. She would have to fake Alice's voice and tell Bob the code is "456" and it's ok. Then to Alice in Bob's voice that the code is "123" and it's ok. All in such a way that Alice and Bob don't suspect anything (has to be realtime too). So this kind of software might make that easier. The way to bypass that is to use dictionary words instead of numbers but then also refer to them further in the conversation. (see silly example in a sister comment about it).
SAI_Peregrinus 10y ago
This software is specifically mentioned to work at the phoneme level, not the word level. So it shouldn't be any harder to mimic words that weren't in the original corpus, as long as the phonemes are known.
- rdtsc 10y ago
  The idea with the man-in-the-middle attack there is that the words would be different, say Alice and Bob want to talk but Eve MitM-ed them, as she always does. Alice sees "pink elephant salad" and Bob sees "piano lamps". They say the words, Eve has to reply in Alice's voice to Bob with "piano lamps" and then respond to Alice with "ping elephant salad". However then Alice makes a joke wondering if elephants like to eat pink salad. Bob will wonder as perhaps he wanted to remark how so few people play pianos these days. So Eve has a bit of a harder job if say instead it was just "1234" vs "5678" being said.

by rdtsc 10y ago

jameshart 10y ago

This is literally the plot of Sneakers, the 1992 hacking movie. I would hope voice signature systems are beyond "Hi, my name is Werner Brandes. My voice is my passport. Verify Me."

amyjess 10y ago
...and now I realize that the voice print part of Uplink was a reference to a movie.
rdtsc 10y ago
Ha, good point. I forgot about Sneakers. This is a bit different though. The idea is that both parties should see the same authentication string and then verify verbally what that is. Say they see "123" so Alice say "I have 123 as my SAS code, what do you have?". And "Bob says, yap I have 123 as well". If Eve is in the middle then she would show "123" to Alice but maybe "456" to Bob. She would have to fake Alice's voice and tell Bob the code is "456" and it's ok. Then to Alice in Bob's voice that the code is "123" and it's ok. All in such a way that Alice and Bob don't suspect anything (has to be realtime too). So this kind of software might make that easier. The way to bypass that is to use dictionary words instead of numbers but then also refer to them further in the conversation. (see silly example in a sister comment about it).

SAI_Peregrinus 10y ago

This software is specifically mentioned to work at the phoneme level, not the word level. So it shouldn't be any harder to mimic words that weren't in the original corpus, as long as the phonemes are known.

rdtsc 10y ago
The idea with the man-in-the-middle attack there is that the words would be different, say Alice and Bob want to talk but Eve MitM-ed them, as she always does. Alice sees "pink elephant salad" and Bob sees "piano lamps". They say the words, Eve has to reply in Alice's voice to Bob with "piano lamps" and then respond to Alice with "ping elephant salad". However then Alice makes a joke wondering if elephants like to eat pink salad. Bob will wonder as perhaps he wanted to remark how so few people play pianos these days. So Eve has a bit of a harder job if say instead it was just "1234" vs "5678" being said.