9 ms·

From the article comments: > Many banks including TD Bank on the East Coast of The US, and throughout Canada are now using voice recognition technology for the

From the article comments: > Many banks including TD Bank on the East Coast of The US, and throughout Canada are now using voice recognition technology for their telephone banking. > You can only imagine how easily that is spoofed as well. That's absolutely hilarious... because the technology that allows a person's voice to be recognized is the exact same technology that allows it to be imitated.

dave5104 7y ago
Schwab Bank started using voice recognition "passwords" as well. Luckily, it requires you to log into their website after talking through voice password tutorial to activate the voice password--which I refused to do at the time. Good to know I made a decent choice.
- dave84 7y ago
  Reminds me of my favorite 'hacking' movie Sneakers: "Hi, my name is Werner Brandes. My voice is my passport. Verify Me."
- lotsofpulp 7y ago
  Fidelity has you put in your online password via the number pad. Have fun if you use a secure 20 digit randomly generated password.
  - mindslight 7y ago
    Never mind the insanity of leaking a secret that would otherwise only travel over TLS. Banks wouldn't know actual security if it fell into their lap. They got spoiled by pretending SSNs were somehow private, and are still trying to use "identification" as a crutch rather than focusing on proper authorization - eg a hierarchy of auth levels with the master being a public key on a hardware token, ideally that you go into a branch to replace. The only thing a person can do is refuse their snake oil voiceprints etc wherever possible, and most importantly monitor your accounts religiously at least every 40 days. Even worse, the snake oil is leaking to non-banks as well. For example, Amazon now seems to insist on doing an email challenge for every login. Very unfriendly UX. Eventually I'll get around to writing a procmail recipe that grabs the codes out of emails/texts, and spits them to a terminal ready to be pasted.
    - Nursie 7y ago
      Most banks in the UK have given out hardware 2fa devices for years. I have one for my company accounts that's activated with its own PIN that gives out logon and authorisation codes. Is this not true in the US? They are often now replaced by banking apps that offer a similar feature, as my consumer account with the same bank has done.
      - lotsofpulp 7y ago
        When it comes to banks, if it makes life easy for the customer, it’s probably not true in the US. We still don’t have chip and PIN, and we most certainly don’t have TOTP 2FA.
awryoyster 7y ago
Government services in Australia have been implementing this technology as well. I hope it won't become mandatory ️
canjobear 7y ago
Voice recognition is far more advanced than voice generation.
- hoseja 7y ago
  Not if it's GAN, no?
asdff 7y ago
I once had my car towed by the city, only I had no way to tell it was them because it's not like they tell you. I figured I'd call the tow yard before I filed a police report for a stolen vehicle. Completely automated system where you had to give them the social security number of whoever had the title to verify whether or not they had the car in the lot. At the time the car was in my dads name, so I had to give this automated system that I had no way of knowing was legit my dads social security number over the phone. They did have the car at least, but boy if a scammer had a spoofed phone number 1 digit off from the towyard's, they would be sitting on a lot of people's social security numbers right now.
Angostura 7y ago
Yes, my family think I’m a Luddite for not using HSBCs voice recognition security on telephone banking

dave5104 7y ago

Schwab Bank started using voice recognition "passwords" as well. Luckily, it requires you to log into their website after talking through voice password tutorial to activate the voice password--which I refused to do at the time. Good to know I made a decent choice.

dave84 7y ago
Reminds me of my favorite 'hacking' movie Sneakers: "Hi, my name is Werner Brandes. My voice is my passport. Verify Me."
lotsofpulp 7y ago
Fidelity has you put in your online password via the number pad. Have fun if you use a secure 20 digit randomly generated password.
- mindslight 7y ago
  Never mind the insanity of leaking a secret that would otherwise only travel over TLS. Banks wouldn't know actual security if it fell into their lap. They got spoiled by pretending SSNs were somehow private, and are still trying to use "identification" as a crutch rather than focusing on proper authorization - eg a hierarchy of auth levels with the master being a public key on a hardware token, ideally that you go into a branch to replace. The only thing a person can do is refuse their snake oil voiceprints etc wherever possible, and most importantly monitor your accounts religiously at least every 40 days. Even worse, the snake oil is leaking to non-banks as well. For example, Amazon now seems to insist on doing an email challenge for every login. Very unfriendly UX. Eventually I'll get around to writing a procmail recipe that grabs the codes out of emails/texts, and spits them to a terminal ready to be pasted.
  - Nursie 7y ago
    Most banks in the UK have given out hardware 2fa devices for years. I have one for my company accounts that's activated with its own PIN that gives out logon and authorisation codes. Is this not true in the US? They are often now replaced by banking apps that offer a similar feature, as my consumer account with the same bank has done.
    - lotsofpulp 7y ago
      When it comes to banks, if it makes life easy for the customer, it’s probably not true in the US. We still don’t have chip and PIN, and we most certainly don’t have TOTP 2FA.

awryoyster 7y ago

Government services in Australia have been implementing this technology as well. I hope it won't become mandatory ️

canjobear 7y ago

Voice recognition is far more advanced than voice generation.

hoseja 7y ago
Not if it's GAN, no?

asdff 7y ago

I once had my car towed by the city, only I had no way to tell it was them because it's not like they tell you. I figured I'd call the tow yard before I filed a police report for a stolen vehicle. Completely automated system where you had to give them the social security number of whoever had the title to verify whether or not they had the car in the lot. At the time the car was in my dads name, so I had to give this automated system that I had no way of knowing was legit my dads social security number over the phone. They did have the car at least, but boy if a scammer had a spoofed phone number 1 digit off from the towyard's, they would be sitting on a lot of people's social security numbers right now.

Angostura 7y ago

Yes, my family think I’m a Luddite for not using HSBCs voice recognition security on telephone banking