3 ms·

Did she bother changing her voice on the phone vs. when she met Mary in person? For familiar voices, it's often pretty easy to know who's speaking even when the

Did she bother changing her voice on the phone vs. when she met Mary in person? For familiar voices, it's often pretty easy to know who's speaking even when they change their pitch or accent, but maybe it was practical to assume that Mary wouldn't be able to notice a voice she'd only heard once on the phone. Obviously this isn't a key part of the exploit since she could've always gotten someone else to do the phone conversation, just wondering how careful she needs to be with those sorts of details to avoid something going wrong.

salamancara 9y ago
So I do a similar kind of work, and I have a bit of an advantage since I am a transgender woman. You would never know from looking at me and I did extensive vocal therapy to reach a feminine speaking voice (but I can still use my deep voice as well). I can be John, Lisa, Mike, Amanda; whoever I want by doing just what you say here. I have a few accents I do; but thats more just for fun (it’s a job like any other). You could definitely get by without it though; everyone who does this kind of work has a slightly different methodology they like to use. Generally this type of on-premise pen testing is a solo enterprise. People working together look suspicious and many of these secure environments require you to lock up your cell phone — so using a phone to communicate with a partner would raise red flags. I mean, I work with other people on the overall assessment, but the site entry part is necessarily pretty sensitive so usually only the head of security at the client is in the know (that way if I get caught, I don’t get shot — though that is less of an issue now as a woman).
phailhaus 9y ago
People can barely tell the difference between two pictures if you pause for a second between showing each one. Being able to tell that two voices are the same after hearing them days apart, once on a phone? I doubt she has to worry, unless she has a distinct accent.
- EGreg 9y ago
  Finding minute differences between pictures is a much harder problem than matching voices to those you've heard before. In the second one there are lots of possible heuristics you could use, and the attacker would have to prevent all the most common ones at least.
  - phailhaus 9y ago
    They're not even minute differences. One example toggles between two pictures of an airplane, with the second having the engines photoshopped out. Just a one-second delay is enough to make it difficult to notice what changed. Now of course it's easy if the two pictures (or voices) are completely different. But who would be suspicious if the two voices sounded similar?

salamancara 9y ago

So I do a similar kind of work, and I have a bit of an advantage since I am a transgender woman. You would never know from looking at me and I did extensive vocal therapy to reach a feminine speaking voice (but I can still use my deep voice as well). I can be John, Lisa, Mike, Amanda; whoever I want by doing just what you say here. I have a few accents I do; but thats more just for fun (it’s a job like any other). You could definitely get by without it though; everyone who does this kind of work has a slightly different methodology they like to use. Generally this type of on-premise pen testing is a solo enterprise. People working together look suspicious and many of these secure environments require you to lock up your cell phone — so using a phone to communicate with a partner would raise red flags. I mean, I work with other people on the overall assessment, but the site entry part is necessarily pretty sensitive so usually only the head of security at the client is in the know (that way if I get caught, I don’t get shot — though that is less of an issue now as a woman).

phailhaus 9y ago

People can barely tell the difference between two pictures if you pause for a second between showing each one. Being able to tell that two voices are the same after hearing them days apart, once on a phone? I doubt she has to worry, unless she has a distinct accent.

EGreg 9y ago
Finding minute differences between pictures is a much harder problem than matching voices to those you've heard before. In the second one there are lots of possible heuristics you could use, and the attacker would have to prevent all the most common ones at least.
- phailhaus 9y ago
  They're not even minute differences. One example toggles between two pictures of an airplane, with the second having the engines photoshopped out. Just a one-second delay is enough to make it difficult to notice what changed. Now of course it's easy if the two pictures (or voices) are completely different. But who would be suspicious if the two voices sounded similar?