10 ms·

I Broke into a Bank Account with an AI-Generated Voice

woliveirajr 4y ago
> My voice is my password No, your voice (like your fingerprint, iris, SSN, passport number, or any other relatively immutable thing) might be your identification or "a thing that you have". Password is something you choose, you change when you want, and that you shouldn't reveal to anyone.
- jbaczuk 4y ago
  "biometrics"
- blitzar 4y ago
  My Voice Is My Passport, Verify Me - https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64
  - dingusdew 4y ago
    [dead]
  - thewebcount 4y ago
    This was the first thing I thought of when I read that. I was like, "Is this the author being cheeky and not really saying what the phrase is, or did someone who works for the bank think they were being clever re-using this line that a 30 year old movie shows is super-easy to spoof?"
    - vatys 4y ago
      > 30 year old movie It may be a shock but that movie will actually turn 41 this summer. It seems the author has shown that a replicant can trick a bank.
      - Tryk 4y ago
        31*
  - EGreg 4y ago
    This is bad and insecure. Look at this: https://m.youtube.com/watch?v=rERApU26PcA https://m.youtube.com/watch?v=rERApU26PcA Same thing with “pay with your face” they tried in China. They all are susceptible to replay attacks. It is garbage! The only secure way to authorize actions is to have a device in your possession which you unlock with your password and/or biometrics — and use THAT device to sign interactive challenges or ZK-SNARKS. The device could stores keys in a secure enclave, but regardless, the keys should never leave the device. The ability to export private keys (as with ethereum and bitcoin wallets) is insecure, too. Look how 1password does it: local key plus master password. Far better than LastPass (master password only). Also you should have notifications whenever a new device authenticates, or when you are trying to establish new recurring payments at a great rate than you would allow otherwise. Then you need to confirm from other devices. That is the scheme that works universally and the further you depart from that, the more ridiculous hacks you get.
    - aziaziazi 4y ago
      > which you unlock with your password and/or biometrics Does this kind of devices really comes in biometric versions ? As someone else mention, unlocking an ATM (or anything else) with a device and your fingerprint is very vulnerable to “steal device and cut finger”.
      - EGreg 4y ago
        Sure. Your iPhone unlocks using your fingerprint or face. But the point is that YOUR iPhone is what’s being unlocked with it — not a machine operated by someone else.
    - throwawayapples 4y ago
      agreed with first two sentences. but, "..which you unlock with your password and/or biometrics"? unlocking with biometrics is actually the problem, regardless of where the unlocking takes place. relying on a third-party device that you can't even verify is in the custody of its user as "the only secure way to authorize actions" is highly problematic for similar reasons. and confirming "from other devices" rapidly turns into a user nightmare. the irony in all this is that lengthy, strong, non-reused passwords are actually pretty secure, and they don't require any specialized technology or rely on possessing a device that you just forgot on the airplane seat pocket and is now winging its way toward another country.
- hbcondo714 4y ago
  Yeah, Vanguard has been using this since 2014: [1] https://www.bogleheads.org/forum/viewtopic.php?t=137530 https://www.bogleheads.org/forum/viewtopic.php?t=137530
- Manfred 4y ago
  Your voice is a thing that you “are”, up to a certain extent. People can be trained to sound like other people. Physical things other than the body is something you “have”.
  - deleted 4y ago
    [deleted]
- Blahah 4y ago
  It's "a thing that you are", as opposed to: "a thing that you have": a key, an ID card, security fob, official uniform, etc. "a thing that you know": a password, PIN, the answer to a secret question, secret handshake, etc.
williamcotton 4y ago
Try that at the DMV! It’s almost like if the DMV issued IDs with public key cryptography support and maintained a public certificate authority that we would have a much more reliable form of identification… a bank has customers they aim to please. The DMV does not aim to please anyone!
- f38zf5vdt 4y ago
  I feel like a broken record, but in the near future we are going to switch to a public key authentication object for everything social we do. Payment has already moved to it: tap payments use public key cryptography. Yet, at the same time, whenever it is brought up people love to engage in contrarian rambles about how it is simply too hard, people will lose their dongles, etc etc. Most phones support NFC communications these days, it's a tap against a phone or reader for verification and so couldn't be easier. Within 10 years people are going to wonder how we ever lived _without_ this.
  - JohnFen 4y ago
    > Most phones support NFC communications these days There are signs of a trend of people getting rid of their smartphones in favor of dumbphones. (Disclaimer -- I will be doing this when my smartphone dies.) So using them for payment may not, in fact, become ubiquitous. Even now, just watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment.
    - f38zf5vdt 4y ago
      Yes, I phrased this badly. I meant that instead of using the phone's NFC for verification, we can use a small NFC device that we tap to the phone and which the phone reads via NFC to verify our identities. Just like we tap our cards to payment terminals.
    - kwhitefoot 4y ago
      There is no reason why simple non-smart phones should not support NFC. > watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment. It seem more like 50% here in central Norway, perhaps more.
JohnFen 4y ago
Banks are using voice ID for important authentication?? That's bordering on insanity.
- toomuchtodo 4y ago
  https://www.fidelity.com/security/fidelity-myvoice/overview https://www.fidelity.com/security/fidelity-myvoice/overview https://investor.vanguard.com/trust-security/security-center https://investor.vanguard.com/trust-security/security-center https://www.schwab.com/voice-id https://www.schwab.com/voice-id https://www.morganstanley.com/what-we-do/wealth-management/online-security/voiceid https://www.morganstanley.com/what-we-do/wealth-management/o... https://www.bnymellon.com/us/en/insights/all-insights/five-digital-technologies-for-fighting-fraud.html https://www.bnymellon.com/us/en/insights/all-insights/five-d...
  - JohnFen 4y ago
    Wow. I just finished reading all of those, and the amount of nonsense and unsupported assertions in them is truly mind-boggling. I'd love to see what, if any, evidence they have to back up the claims they're making.
  - logicalmonster 4y ago
    Forget AI-generated voices for a second. How are these tools trustworthy for defending against simple low-tech hacking like recording somebody's voice and editing it together in the right pattern? These old comical soundboards of celebrity voices are imperfect as the audio often has different volume levels and subtle background noise, but illustrates the general principle. With an intense enough effort, you can record enough audio from a person to put together a natural conversation. It takes some effort, but is not outside of the technical capabilities for even a smart 14 year old to set this up. https://www.101soundboards.com/boards/10716-arnold-schwarzenegger-soundboard https://www.101soundboards.com/boards/10716-arnold-schwarzen... Unless these financial security systems have a way to look for very subtle, unnatural gaps in the audio or the consistency of the audio quality, the voice pattern that exists could be a perfect match with this kind of tactic. The handful of times I've had to contact Fidelity, their customer service has been exceptionally professional. The only annoying part of the process is trying to insert a long password via the phone dialpad to verify my identity. I've been given the suggestion to setup their MyVoice feature, but have resisted setting that up because it seems like there's a possibility it could be bypassed.
adrianmonk 4y ago
Biometrics work (in their limited way) only if you control the hardware and the physical environment. You can measure something unique and check that it's as expected, but that's only valid if there's proper custody on the measurement and resulting data. It's a pretty simple concept, but people perennially can't figure it out. Or don't care. So, if you're going to use biometrics, a retina scan on a bank vault might be reasonable, but a web site that does facial recognition with the user's camera is not.
- 3np 4y ago
  In principle, your are correct and one should act accordingly. In practice, it's an arms race. Plug some more sensors and hardware enclave on the next smartphone generation and flame up the zero-trust hype and it'll be a while until you can covertly unlock your spouse's phone or steal your flatmates custodied crypto even as a well-funded hacker. The colletaral damage of individual autonomy as end-user devices, apps, and services are dragged along and slowly becoming the only gateways into the financial system and large parts of the private and public social room is rather quite unfortunate.
  - adrianmonk 4y ago
    Well, now you get into DRM and its kin. Which is really a conflict of values. If party A (the owner/user) has control of the hardware, there are certain things it enables, like doing what you want with the hardware you paid for. If party B (the vendor/manufacturer) has control of the hardware, it enables other things like participating in games with stronger anti-cheat mechanisms or quicker authentication when doing a payment. Some of these things have value to only one party, and some of them might have value to both. You're never going to make everybody happy when values conflict. Plus it gets extra complicated because values vary. Maybe one end user cares less about control and more about convenience, and another end user is the opposite.
- justin_oaks 4y ago
  Yup. Remote biometrics? Forget about it. Another big problem with biometrics is that if they're "stolen" then you can't revoke them. That said, if you control the hardware and physical environment where the biometrics are used then it's hard to use the stolen biometrics. I could see a case for going to an office that was approved by the government to verify your biometrics. That way the hardware and physical environment would be controlled. The office could have people verifying that you don't, for example, have fake fingerprints over your real ones. Then that office could act like a certificate authority and generate a certificate that links your identity to a newly generated public key. Then all authentication would be done using the private key and certificate instead of using the biometrics directly. In such a case, stolen biometric data wouldn't be useful since it'd be hard to get past physical inspection.
meepmorp 4y ago
Here's a question I have - how easy is it to fool the detector? Phone lines are frequency limited and connections are sometimes poor. Apparently you can fool it with a recording of the target speaker, but what about an computer generated voice? And are the features it's detecting things you could correlate with information you could gather on a subject - age, gender, place of birth - to produce a good enough match for enough people to make automated targeted attacks possible.
- JohnFen 4y ago
  It's not really that hard. You don't even need AI to do it. You do have to know what you're doing, though.
  - aziaziazi 4y ago
    Seems interesting, may you share more details ?
    - JohnFen 4y ago
      This isn't really the right venue for such detail, but a wealth of information is a search away. Sorry to be evasive, but the security guy in me is much more comfortable being evasive about things that could be leveraged against people.
jacksnipe 4y ago
Wait isn’t this the plot to the original Charlie’s Angels movie?!
- acomjean 4y ago
  "sneakers" https://en.wikipedia.org/wiki/Sneakers_(1992_film) https://en.wikipedia.org/wiki/Sneakers_(1992_film)
bmitc 4y ago
The title alone reminded me of the scenes in Archer of Archer accessing the mainframe using the voice from a voicemail prompt. https://youtu.be/X1AjJVbQo7M https://youtu.be/X1AjJVbQo7M
gabereiser 4y ago
"My voice is my password" brings back memories of hacking banks, only in Uplink. What?!? How is this security? Even back in 2000 this is a bad idea. It's even worse today.
- lightspot21 4y ago
  >Uplink Woah. I haven't heard about this game in like a decade! Thanks for the nostalgia.
  - lukevp 4y ago
    This game was so fun! It was one of the things that got me interested in software development, along with Learn to Program BASIC (a game about programming games)
  - gabereiser 4y ago
    My grey beard must be showing. I remember it like it was yesterday. The pure OpenGL graphics, the "slide in from the right" email "spam". The matrix-like tumbler of hex that would "crack" an encryption. It was a perfect game for a small studio.
  - therein 4y ago
    I think many of us played that game a little too much when we were young. I remember always going back to it.
  - Tryk 4y ago
    Great game, it's actually on Steam. [1] https://store.steampowered.com/app/1510/Uplink/ https://store.steampowered.com/app/1510/Uplink/
- e12e 4y ago
  2000?! Never forget - "Sneakers". Get off my lawn.. ;) https://m.youtube.com/watch?v=-zVgWpVXb64 https://m.youtube.com/watch?v=-zVgWpVXb64
  - 4y ago
hospadar 4y ago
I went to a really interesting talk about biometrics from the guy who ran (runs?) the HUGE biometric ID program that India runs (Aadhaar). A point I remember him reiterating several times is that biometric ID is useful to uniquely identify human meat-bodies (my paraphrase), but that it's fairly weak if you're using biometrics for authentication. His idea being that your biometric data is not really secret (i.e. in the case of fingerprints or face, it's attached to your body and easily observable), and also that it cannot be changed (easily, with today's technology). If someone gets their hands on your fingerprints or retina scan, you can't "change your password". His point was that biometrics are really useful for stuff like KYC when you get a bank account (where bank employees can feel pretty sure that they are really scanning your eyeball and not a picture of your eyeball reproduced for the camera), but not such a good idea for stuff like "are you allowed to access this ATM machine?". Also, while identity theft sucks, getting your password stolen is painless, whereas someone chopping off your thumbs to squish them up to an ATM machine is a less pleasant experience.
- prettyStandard 4y ago
  Biometrics are an username, not a password.
  - acchow 4y ago
    Except on hundreds of millions of iPhones around the world. Apple has shown that the distinction is more nuanced. There are cases where biometric use is legitimate. Signing into an account on a remote server? Probably not. To access the secure enclave on a device that is with you for 100% of your life? Probably fine.
    - TacticalCoder 4y ago
      > To access the secure enclave on a device that is with you for 100% of your life? Probably fine. The notion, however, that a device shall be with you for 100% of your life is not fine at all. It's totally dystopian.
foxandmouse 4y ago
We might need to go back to physical authentication methods with advancements in Ai and considering the potential of quantum computing
foxandmouse 4y ago
We already know the limitation of physical authentication, which is why digital is so convenient but with advancements in Ai and considering the potential of quantum computing I wonder where we’ll turn to next… maybe there will actually be a use for the blockchain
throwaway_13140 4y ago
> I had access to the account information, including balances and a list of recent transactions and transfers. But could you make a transaction? The title is a little sensationalist.
- yazzku 4y ago
  Vice is putting a lot of clickbait out there these days. Then, on the other hand, the HN post is nearly verbatim of the Vice headline, so not sure if that's enough for flagging. Personally, if I had posted this, I'd have removed the clickbait.
mcoliver 4y ago
A theory I have had for a while (when I put on my tinfoil hat) is that all those robocalls are really looking to generate a voice print of the person associated with a number for future nefarious purposes. For example most people will answer and say "hello, hello, anyone there?" Or something to that effect. Or it will go to voicemail which can then capture their voice. Yet another reason I don't answer calls from people I don't know and use a generic computer generated voicemail message.
- beepbooptheory 4y ago
  This is probably still not advisable, but whenever I get one those calls where I happen to be curious enough to answer, I wait for a beat to see if anyone says anything, and if they don't I start screeching, making monkey noises, farting sounds, and it always just hangs up as soon as I start.
ofchnofc 4y ago
I love when I call US financial institutes and are reminded that: 1. They insist on using voice menus that are only ever capable of servicing requests that I can already do online, or don't work because they're jammed up by the same backend issue that their website hits. 2. They try to auto-enroll me in Voice ID despite always going out of my way to demand that feature not be enabled. 3. Use TOTPs sent to SMS instead of any halfway reasonable TOTP/FIDO2 solution. US Banks are a joke. So much so that I actively root for them to be hacked so a light can be shone on the fact that my god damn Xbox account is far more secure (first line security) than my Bank account (I do realize that Schwab will probably make me whole faster than Microsoft would in the case of some act of God compromise).
- jklinger410 4y ago
  Also your personal data and financial details are being directly sold by them or stolen by tracking pixels. Once you realize there are no banks at a consumer level who keep your information private in any way, the idea of privacy in the US becomes a complete joke.
- LetsGetTechnicl 4y ago
  At least you have some recourse and protection if something happens to your bank account, unlike an Xbox account where Microsoft can just deny access for any reason. But I'm also grateful my credit union has an online portal that has 2FA with authentication app support and the ability to disable SMS, phone call and email 2FA options.
LetsGetTechnicl 4y ago
I've called Spectrum a few times and they offer this tech too and I always wondered how secure it could be if it's running over regular telephone calls. Like the audio quality isn't great so how well can it differentiate voices and particular characteristics
danShumway 4y ago
I'm not really sure the addition of AI changes all that much here. It sounds like the bypass the author used would have been possible using conventional methods. But if AI draws attention to the horrendous practice of biometric authentication, I'm all for it and I hope that more reporters start asking similar questions about bank security. This article focuses specifically on UK security, and I'm not sure what the situation is over there, but in the US digital security around banks is pretty awful. I looked around a while back trying to find an online consumer bank with good reviews that offered 2-factor authentication (real 2-factor authentication, not just SMS). I couldn't find a single one[0]. At best, a couple of banks mentioned that they had their own proprietary authentication apps that I could install. None of them had basic OTP support for something like AndOTP. I had to fight with my bank for multiple days before I got them to allow me to set up a passcode that they would use to identify me when I called, rather than just relying on basic information that was all made public in the Equifax leak. To their credit, they do actually ask me, but I still wonder if someone tried to impersonate me, would they actually block access or would they bend as soon as the person made a fuss about not knowing the code? That the response to this from the banks involved is immediately "well, it's just an extra layer, we're getting better and better" -- it's infuriating to read. It's an industry that is not just behind on security, it's actively hostile to people pointing out that it's behind on security. I guess it should make me feel better that apparently it's not just a US-specific problem? I'm not sure it does though. ---- [0]: Sidenote, if anyone has any good suggestions here, I'd be all ears. I get regularly annoyed at how bad my bank is with notifications around payments, card usage, etc... and how it seems to be both antagonistic to actual security measures like 2FA and in love with security theater like blocking VPN access.
- PascLeRasc 4y ago
  Right now, the only options are Charles Schwab with a workaround [1], and Wealthfront and Betterment with native OTP 2FA. These are actually pretty great accounts regardless of security, >4% interest on savings and no ATM fees ever. The only credit card I've been able to find with non-SMS 2FA and no SMS fallback is the Apple card. [1] https://www.reddit.com/r/personalfinance/comments/hvvuwl/using_google_auth_or_your_totp_app_of_choice_for/ https://www.reddit.com/r/personalfinance/comments/hvvuwl/usi...
01100011 4y ago
Your voice is indeed a form of authentication to other people that know you. How long until it becomes a valuable token which needs to be protected? I can see various forms of 'man in the middle' attacks taking place with selective conversational interposing allowing an attacker to inject false data into a live conversation between two parties. Imagine a simple example using caller ID spoofing: Attacker calls two parties and uses stolen voices to establish a reason for the call(as both people will know they did not instigate the conversation, both will need to be convinced that the other party did). Now the conversation is started and has context. Now the attacker can steer the conversation to various topics and selectively invert various factual exchanges or negotiations. Afterwards, both parties will be left with a valid memory of the interaction and, unless they confer on who instigated the call, may have little reason to suspect that sections of the exchange were manipulated.
- ulnarkressty 4y ago
  This can be mitigated somewhat if both parties agree on a secret exchange in advance. I guess it's just a matter of time until parents all over will have challenge-response sheets next to the phone to prevent them from wiring money to their "son" who's been in a terrible accident.
  - 01100011 4y ago
    Somewhat, but when the attacker controls the channel they can allow the challenge-response to complete before compromising the integrity of the channel.
zizee 4y ago
How long until people start recieving voicemails from scammers in their boss's voice? How long until we can filter voices in real time to convert anyone to sound like anyone else? Video is also not that far away. Will I be able to send my AI doppleganger to videocall standups? It will be interesting to see if we have to take extra steps to verify we are on any non-physically present communications. Email is already suspect. Phone calls are next. On the plus side, it will help enable things like proper double blind interviews, to allow for gender bias free interviews. It will also help anonymity, or people with disabilities.
sjkoelle 4y ago
https://www.forbes.com/sites/thomasbrewster/2021/10/14/huge-bank-fraud-uses-deep-fake-voice-tech-to-steal-millions/?sh=1cf5e5c27559 https://www.forbes.com/sites/thomasbrewster/2021/10/14/huge-...
_ah 4y ago
Every time I've called my broker they've asked to enable Voice ID as their "most secure form of authentication!". Hard pass. The poor reps on the phone are always very confused.
mayormcmatt 4y ago
"My voice is my passport. Verify me."
gloosx 4y ago
I just don't understand how come this is so much of an oversight, neural networks today can synthesise voice, pictures. ALSO neural networks today can reliably detect if a picture or voice was generated by neural networks. How come someone skipping the latter in a security application? A BANK? I just don't understand.
deleted 4y ago
[deleted]

> My voice is my password No, your voice (like your fingerprint, iris, SSN, passport number, or any other relatively immutable thing) might be your identification or "a thing that you have". Password is something you choose, you change when you want, and that you shouldn't reveal to anyone.

jbaczuk 4y ago
"biometrics"
blitzar 4y ago
My Voice Is My Passport, Verify Me - https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64
- dingusdew 4y ago
  [dead]
- thewebcount 4y ago
  This was the first thing I thought of when I read that. I was like, "Is this the author being cheeky and not really saying what the phrase is, or did someone who works for the bank think they were being clever re-using this line that a 30 year old movie shows is super-easy to spoof?"
  - vatys 4y ago
    > 30 year old movie It may be a shock but that movie will actually turn 41 this summer. It seems the author has shown that a replicant can trick a bank.
    - Tryk 4y ago
      31*
- EGreg 4y ago
  This is bad and insecure. Look at this: https://m.youtube.com/watch?v=rERApU26PcA https://m.youtube.com/watch?v=rERApU26PcA Same thing with “pay with your face” they tried in China. They all are susceptible to replay attacks. It is garbage! The only secure way to authorize actions is to have a device in your possession which you unlock with your password and/or biometrics — and use THAT device to sign interactive challenges or ZK-SNARKS. The device could stores keys in a secure enclave, but regardless, the keys should never leave the device. The ability to export private keys (as with ethereum and bitcoin wallets) is insecure, too. Look how 1password does it: local key plus master password. Far better than LastPass (master password only). Also you should have notifications whenever a new device authenticates, or when you are trying to establish new recurring payments at a great rate than you would allow otherwise. Then you need to confirm from other devices. That is the scheme that works universally and the further you depart from that, the more ridiculous hacks you get.
  - aziaziazi 4y ago
    > which you unlock with your password and/or biometrics Does this kind of devices really comes in biometric versions ? As someone else mention, unlocking an ATM (or anything else) with a device and your fingerprint is very vulnerable to “steal device and cut finger”.
    - EGreg 4y ago
      Sure. Your iPhone unlocks using your fingerprint or face. But the point is that YOUR iPhone is what’s being unlocked with it — not a machine operated by someone else.
  - throwawayapples 4y ago
    agreed with first two sentences. but, "..which you unlock with your password and/or biometrics"? unlocking with biometrics is actually the problem, regardless of where the unlocking takes place. relying on a third-party device that you can't even verify is in the custody of its user as "the only secure way to authorize actions" is highly problematic for similar reasons. and confirming "from other devices" rapidly turns into a user nightmare. the irony in all this is that lengthy, strong, non-reused passwords are actually pretty secure, and they don't require any specialized technology or rely on possessing a device that you just forgot on the airplane seat pocket and is now winging its way toward another country.
hbcondo714 4y ago
Yeah, Vanguard has been using this since 2014: [1] https://www.bogleheads.org/forum/viewtopic.php?t=137530 https://www.bogleheads.org/forum/viewtopic.php?t=137530
Manfred 4y ago
Your voice is a thing that you “are”, up to a certain extent. People can be trained to sound like other people. Physical things other than the body is something you “have”.
- deleted 4y ago
  [deleted]
Blahah 4y ago
It's "a thing that you are", as opposed to: "a thing that you have": a key, an ID card, security fob, official uniform, etc. "a thing that you know": a password, PIN, the answer to a secret question, secret handshake, etc.

williamcotton 4y ago

Try that at the DMV! It’s almost like if the DMV issued IDs with public key cryptography support and maintained a public certificate authority that we would have a much more reliable form of identification… a bank has customers they aim to please. The DMV does not aim to please anyone!

f38zf5vdt 4y ago
I feel like a broken record, but in the near future we are going to switch to a public key authentication object for everything social we do. Payment has already moved to it: tap payments use public key cryptography. Yet, at the same time, whenever it is brought up people love to engage in contrarian rambles about how it is simply too hard, people will lose their dongles, etc etc. Most phones support NFC communications these days, it's a tap against a phone or reader for verification and so couldn't be easier. Within 10 years people are going to wonder how we ever lived _without_ this.
- JohnFen 4y ago
  > Most phones support NFC communications these days There are signs of a trend of people getting rid of their smartphones in favor of dumbphones. (Disclaimer -- I will be doing this when my smartphone dies.) So using them for payment may not, in fact, become ubiquitous. Even now, just watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment.
  - f38zf5vdt 4y ago
    Yes, I phrased this badly. I meant that instead of using the phone's NFC for verification, we can use a small NFC device that we tap to the phone and which the phone reads via NFC to verify our identities. Just like we tap our cards to payment terminals.
  - kwhitefoot 4y ago
    There is no reason why simple non-smart phones should not support NFC. > watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment. It seem more like 50% here in central Norway, perhaps more.

JohnFen 4y ago

Banks are using voice ID for important authentication?? That's bordering on insanity.

toomuchtodo 4y ago
https://www.fidelity.com/security/fidelity-myvoice/overview https://www.fidelity.com/security/fidelity-myvoice/overview https://investor.vanguard.com/trust-security/security-center https://investor.vanguard.com/trust-security/security-center https://www.schwab.com/voice-id https://www.schwab.com/voice-id https://www.morganstanley.com/what-we-do/wealth-management/online-security/voiceid https://www.morganstanley.com/what-we-do/wealth-management/o... https://www.bnymellon.com/us/en/insights/all-insights/five-digital-technologies-for-fighting-fraud.html https://www.bnymellon.com/us/en/insights/all-insights/five-d...
- JohnFen 4y ago
  Wow. I just finished reading all of those, and the amount of nonsense and unsupported assertions in them is truly mind-boggling. I'd love to see what, if any, evidence they have to back up the claims they're making.
- logicalmonster 4y ago
  Forget AI-generated voices for a second. How are these tools trustworthy for defending against simple low-tech hacking like recording somebody's voice and editing it together in the right pattern? These old comical soundboards of celebrity voices are imperfect as the audio often has different volume levels and subtle background noise, but illustrates the general principle. With an intense enough effort, you can record enough audio from a person to put together a natural conversation. It takes some effort, but is not outside of the technical capabilities for even a smart 14 year old to set this up. https://www.101soundboards.com/boards/10716-arnold-schwarzenegger-soundboard https://www.101soundboards.com/boards/10716-arnold-schwarzen... Unless these financial security systems have a way to look for very subtle, unnatural gaps in the audio or the consistency of the audio quality, the voice pattern that exists could be a perfect match with this kind of tactic. The handful of times I've had to contact Fidelity, their customer service has been exceptionally professional. The only annoying part of the process is trying to insert a long password via the phone dialpad to verify my identity. I've been given the suggestion to setup their MyVoice feature, but have resisted setting that up because it seems like there's a possibility it could be bypassed.

adrianmonk 4y ago

Biometrics work (in their limited way) only if you control the hardware and the physical environment. You can measure something unique and check that it's as expected, but that's only valid if there's proper custody on the measurement and resulting data. It's a pretty simple concept, but people perennially can't figure it out. Or don't care. So, if you're going to use biometrics, a retina scan on a bank vault might be reasonable, but a web site that does facial recognition with the user's camera is not.

3np 4y ago
In principle, your are correct and one should act accordingly. In practice, it's an arms race. Plug some more sensors and hardware enclave on the next smartphone generation and flame up the zero-trust hype and it'll be a while until you can covertly unlock your spouse's phone or steal your flatmates custodied crypto even as a well-funded hacker. The colletaral damage of individual autonomy as end-user devices, apps, and services are dragged along and slowly becoming the only gateways into the financial system and large parts of the private and public social room is rather quite unfortunate.
- adrianmonk 4y ago
  Well, now you get into DRM and its kin. Which is really a conflict of values. If party A (the owner/user) has control of the hardware, there are certain things it enables, like doing what you want with the hardware you paid for. If party B (the vendor/manufacturer) has control of the hardware, it enables other things like participating in games with stronger anti-cheat mechanisms or quicker authentication when doing a payment. Some of these things have value to only one party, and some of them might have value to both. You're never going to make everybody happy when values conflict. Plus it gets extra complicated because values vary. Maybe one end user cares less about control and more about convenience, and another end user is the opposite.
justin_oaks 4y ago
Yup. Remote biometrics? Forget about it. Another big problem with biometrics is that if they're "stolen" then you can't revoke them. That said, if you control the hardware and physical environment where the biometrics are used then it's hard to use the stolen biometrics. I could see a case for going to an office that was approved by the government to verify your biometrics. That way the hardware and physical environment would be controlled. The office could have people verifying that you don't, for example, have fake fingerprints over your real ones. Then that office could act like a certificate authority and generate a certificate that links your identity to a newly generated public key. Then all authentication would be done using the private key and certificate instead of using the biometrics directly. In such a case, stolen biometric data wouldn't be useful since it'd be hard to get past physical inspection.

meepmorp 4y ago

Here's a question I have - how easy is it to fool the detector? Phone lines are frequency limited and connections are sometimes poor. Apparently you can fool it with a recording of the target speaker, but what about an computer generated voice? And are the features it's detecting things you could correlate with information you could gather on a subject - age, gender, place of birth - to produce a good enough match for enough people to make automated targeted attacks possible.

JohnFen 4y ago
It's not really that hard. You don't even need AI to do it. You do have to know what you're doing, though.
- aziaziazi 4y ago
  Seems interesting, may you share more details ?
  - JohnFen 4y ago
    This isn't really the right venue for such detail, but a wealth of information is a search away. Sorry to be evasive, but the security guy in me is much more comfortable being evasive about things that could be leveraged against people.

jacksnipe 4y ago

Wait isn’t this the plot to the original Charlie’s Angels movie?!

acomjean 4y ago
"sneakers" https://en.wikipedia.org/wiki/Sneakers_(1992_film) https://en.wikipedia.org/wiki/Sneakers_(1992_film)

bmitc 4y ago

The title alone reminded me of the scenes in Archer of Archer accessing the mainframe using the voice from a voicemail prompt. https://youtu.be/X1AjJVbQo7M https://youtu.be/X1AjJVbQo7M

gabereiser 4y ago

"My voice is my password" brings back memories of hacking banks, only in Uplink. What?!? How is this security? Even back in 2000 this is a bad idea. It's even worse today.

lightspot21 4y ago
>Uplink Woah. I haven't heard about this game in like a decade! Thanks for the nostalgia.
- lukevp 4y ago
  This game was so fun! It was one of the things that got me interested in software development, along with Learn to Program BASIC (a game about programming games)
- gabereiser 4y ago
  My grey beard must be showing. I remember it like it was yesterday. The pure OpenGL graphics, the "slide in from the right" email "spam". The matrix-like tumbler of hex that would "crack" an encryption. It was a perfect game for a small studio.
- therein 4y ago
  I think many of us played that game a little too much when we were young. I remember always going back to it.
- Tryk 4y ago
  Great game, it's actually on Steam. [1] https://store.steampowered.com/app/1510/Uplink/ https://store.steampowered.com/app/1510/Uplink/
e12e 4y ago
2000?! Never forget - "Sneakers". Get off my lawn.. ;) https://m.youtube.com/watch?v=-zVgWpVXb64 https://m.youtube.com/watch?v=-zVgWpVXb64
- 4y ago

hospadar 4y ago

I went to a really interesting talk about biometrics from the guy who ran (runs?) the HUGE biometric ID program that India runs (Aadhaar). A point I remember him reiterating several times is that biometric ID is useful to uniquely identify human meat-bodies (my paraphrase), but that it's fairly weak if you're using biometrics for authentication. His idea being that your biometric data is not really secret (i.e. in the case of fingerprints or face, it's attached to your body and easily observable), and also that it cannot be changed (easily, with today's technology). If someone gets their hands on your fingerprints or retina scan, you can't "change your password". His point was that biometrics are really useful for stuff like KYC when you get a bank account (where bank employees can feel pretty sure that they are really scanning your eyeball and not a picture of your eyeball reproduced for the camera), but not such a good idea for stuff like "are you allowed to access this ATM machine?". Also, while identity theft sucks, getting your password stolen is painless, whereas someone chopping off your thumbs to squish them up to an ATM machine is a less pleasant experience.

prettyStandard 4y ago
Biometrics are an username, not a password.
- acchow 4y ago
  Except on hundreds of millions of iPhones around the world. Apple has shown that the distinction is more nuanced. There are cases where biometric use is legitimate. Signing into an account on a remote server? Probably not. To access the secure enclave on a device that is with you for 100% of your life? Probably fine.
  - TacticalCoder 4y ago
    > To access the secure enclave on a device that is with you for 100% of your life? Probably fine. The notion, however, that a device shall be with you for 100% of your life is not fine at all. It's totally dystopian.

foxandmouse 4y ago

We might need to go back to physical authentication methods with advancements in Ai and considering the potential of quantum computing

foxandmouse 4y ago

We already know the limitation of physical authentication, which is why digital is so convenient but with advancements in Ai and considering the potential of quantum computing I wonder where we’ll turn to next… maybe there will actually be a use for the blockchain

throwaway_13140 4y ago

> I had access to the account information, including balances and a list of recent transactions and transfers. But could you make a transaction? The title is a little sensationalist.

yazzku 4y ago
Vice is putting a lot of clickbait out there these days. Then, on the other hand, the HN post is nearly verbatim of the Vice headline, so not sure if that's enough for flagging. Personally, if I had posted this, I'd have removed the clickbait.

mcoliver 4y ago

A theory I have had for a while (when I put on my tinfoil hat) is that all those robocalls are really looking to generate a voice print of the person associated with a number for future nefarious purposes. For example most people will answer and say "hello, hello, anyone there?" Or something to that effect. Or it will go to voicemail which can then capture their voice. Yet another reason I don't answer calls from people I don't know and use a generic computer generated voicemail message.

beepbooptheory 4y ago
This is probably still not advisable, but whenever I get one those calls where I happen to be curious enough to answer, I wait for a beat to see if anyone says anything, and if they don't I start screeching, making monkey noises, farting sounds, and it always just hangs up as soon as I start.

ofchnofc 4y ago

I love when I call US financial institutes and are reminded that: 1. They insist on using voice menus that are only ever capable of servicing requests that I can already do online, or don't work because they're jammed up by the same backend issue that their website hits. 2. They try to auto-enroll me in Voice ID despite always going out of my way to demand that feature not be enabled. 3. Use TOTPs sent to SMS instead of any halfway reasonable TOTP/FIDO2 solution. US Banks are a joke. So much so that I actively root for them to be hacked so a light can be shone on the fact that my god damn Xbox account is far more secure (first line security) than my Bank account (I do realize that Schwab will probably make me whole faster than Microsoft would in the case of some act of God compromise).

jklinger410 4y ago
Also your personal data and financial details are being directly sold by them or stolen by tracking pixels. Once you realize there are no banks at a consumer level who keep your information private in any way, the idea of privacy in the US becomes a complete joke.
LetsGetTechnicl 4y ago
At least you have some recourse and protection if something happens to your bank account, unlike an Xbox account where Microsoft can just deny access for any reason. But I'm also grateful my credit union has an online portal that has 2FA with authentication app support and the ability to disable SMS, phone call and email 2FA options.

LetsGetTechnicl 4y ago

I've called Spectrum a few times and they offer this tech too and I always wondered how secure it could be if it's running over regular telephone calls. Like the audio quality isn't great so how well can it differentiate voices and particular characteristics

danShumway 4y ago

I'm not really sure the addition of AI changes all that much here. It sounds like the bypass the author used would have been possible using conventional methods. But if AI draws attention to the horrendous practice of biometric authentication, I'm all for it and I hope that more reporters start asking similar questions about bank security. This article focuses specifically on UK security, and I'm not sure what the situation is over there, but in the US digital security around banks is pretty awful. I looked around a while back trying to find an online consumer bank with good reviews that offered 2-factor authentication (real 2-factor authentication, not just SMS). I couldn't find a single one[0]. At best, a couple of banks mentioned that they had their own proprietary authentication apps that I could install. None of them had basic OTP support for something like AndOTP. I had to fight with my bank for multiple days before I got them to allow me to set up a passcode that they would use to identify me when I called, rather than just relying on basic information that was all made public in the Equifax leak. To their credit, they do actually ask me, but I still wonder if someone tried to impersonate me, would they actually block access or would they bend as soon as the person made a fuss about not knowing the code? That the response to this from the banks involved is immediately "well, it's just an extra layer, we're getting better and better" -- it's infuriating to read. It's an industry that is not just behind on security, it's actively hostile to people pointing out that it's behind on security. I guess it should make me feel better that apparently it's not just a US-specific problem? I'm not sure it does though. ---- [0]: Sidenote, if anyone has any good suggestions here, I'd be all ears. I get regularly annoyed at how bad my bank is with notifications around payments, card usage, etc... and how it seems to be both antagonistic to actual security measures like 2FA and in love with security theater like blocking VPN access.

PascLeRasc 4y ago
Right now, the only options are Charles Schwab with a workaround [1], and Wealthfront and Betterment with native OTP 2FA. These are actually pretty great accounts regardless of security, >4% interest on savings and no ATM fees ever. The only credit card I've been able to find with non-SMS 2FA and no SMS fallback is the Apple card. [1] https://www.reddit.com/r/personalfinance/comments/hvvuwl/using_google_auth_or_your_totp_app_of_choice_for/ https://www.reddit.com/r/personalfinance/comments/hvvuwl/usi...

01100011 4y ago

Your voice is indeed a form of authentication to other people that know you. How long until it becomes a valuable token which needs to be protected? I can see various forms of 'man in the middle' attacks taking place with selective conversational interposing allowing an attacker to inject false data into a live conversation between two parties. Imagine a simple example using caller ID spoofing: Attacker calls two parties and uses stolen voices to establish a reason for the call(as both people will know they did not instigate the conversation, both will need to be convinced that the other party did). Now the conversation is started and has context. Now the attacker can steer the conversation to various topics and selectively invert various factual exchanges or negotiations. Afterwards, both parties will be left with a valid memory of the interaction and, unless they confer on who instigated the call, may have little reason to suspect that sections of the exchange were manipulated.

ulnarkressty 4y ago
This can be mitigated somewhat if both parties agree on a secret exchange in advance. I guess it's just a matter of time until parents all over will have challenge-response sheets next to the phone to prevent them from wiring money to their "son" who's been in a terrible accident.
- 01100011 4y ago
  Somewhat, but when the attacker controls the channel they can allow the challenge-response to complete before compromising the integrity of the channel.

zizee 4y ago

How long until people start recieving voicemails from scammers in their boss's voice? How long until we can filter voices in real time to convert anyone to sound like anyone else? Video is also not that far away. Will I be able to send my AI doppleganger to videocall standups? It will be interesting to see if we have to take extra steps to verify we are on any non-physically present communications. Email is already suspect. Phone calls are next. On the plus side, it will help enable things like proper double blind interviews, to allow for gender bias free interviews. It will also help anonymity, or people with disabilities.

sjkoelle 4y ago

https://www.forbes.com/sites/thomasbrewster/2021/10/14/huge-bank-fraud-uses-deep-fake-voice-tech-to-steal-millions/?sh=1cf5e5c27559 https://www.forbes.com/sites/thomasbrewster/2021/10/14/huge-...

_ah 4y ago

Every time I've called my broker they've asked to enable Voice ID as their "most secure form of authentication!". Hard pass. The poor reps on the phone are always very confused.

mayormcmatt 4y ago

"My voice is my passport. Verify me."

gloosx 4y ago

I just don't understand how come this is so much of an oversight, neural networks today can synthesise voice, pictures. ALSO neural networks today can reliably detect if a picture or voice was generated by neural networks. How come someone skipping the latter in a security application? A BANK? I just don't understand.

deleted 4y ago

[deleted]