5 ms·

> My voice is my password No, your voice (like your fingerprint, iris, SSN, passport number, or any other relatively immutable thing) might be your identificat

> My voice is my password No, your voice (like your fingerprint, iris, SSN, passport number, or any other relatively immutable thing) might be your identification or "a thing that you have". Password is something you choose, you change when you want, and that you shouldn't reveal to anyone.

jbaczuk 4y ago
"biometrics"
blitzar 4y ago
My Voice Is My Passport, Verify Me - https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64
- dingusdew 4y ago
  [dead]
- thewebcount 4y ago
  This was the first thing I thought of when I read that. I was like, "Is this the author being cheeky and not really saying what the phrase is, or did someone who works for the bank think they were being clever re-using this line that a 30 year old movie shows is super-easy to spoof?"
  - vatys 4y ago
    > 30 year old movie It may be a shock but that movie will actually turn 41 this summer. It seems the author has shown that a replicant can trick a bank.
    - Tryk 4y ago
      31*
- EGreg 4y ago
  This is bad and insecure. Look at this: https://m.youtube.com/watch?v=rERApU26PcA https://m.youtube.com/watch?v=rERApU26PcA Same thing with “pay with your face” they tried in China. They all are susceptible to replay attacks. It is garbage! The only secure way to authorize actions is to have a device in your possession which you unlock with your password and/or biometrics — and use THAT device to sign interactive challenges or ZK-SNARKS. The device could stores keys in a secure enclave, but regardless, the keys should never leave the device. The ability to export private keys (as with ethereum and bitcoin wallets) is insecure, too. Look how 1password does it: local key plus master password. Far better than LastPass (master password only). Also you should have notifications whenever a new device authenticates, or when you are trying to establish new recurring payments at a great rate than you would allow otherwise. Then you need to confirm from other devices. That is the scheme that works universally and the further you depart from that, the more ridiculous hacks you get.
  - aziaziazi 4y ago
    > which you unlock with your password and/or biometrics Does this kind of devices really comes in biometric versions ? As someone else mention, unlocking an ATM (or anything else) with a device and your fingerprint is very vulnerable to “steal device and cut finger”.
    - EGreg 4y ago
      Sure. Your iPhone unlocks using your fingerprint or face. But the point is that YOUR iPhone is what’s being unlocked with it — not a machine operated by someone else.
  - throwawayapples 4y ago
    agreed with first two sentences. but, "..which you unlock with your password and/or biometrics"? unlocking with biometrics is actually the problem, regardless of where the unlocking takes place. relying on a third-party device that you can't even verify is in the custody of its user as "the only secure way to authorize actions" is highly problematic for similar reasons. and confirming "from other devices" rapidly turns into a user nightmare. the irony in all this is that lengthy, strong, non-reused passwords are actually pretty secure, and they don't require any specialized technology or rely on possessing a device that you just forgot on the airplane seat pocket and is now winging its way toward another country.
hbcondo714 4y ago
Yeah, Vanguard has been using this since 2014: [1] https://www.bogleheads.org/forum/viewtopic.php?t=137530 https://www.bogleheads.org/forum/viewtopic.php?t=137530
Manfred 4y ago
Your voice is a thing that you “are”, up to a certain extent. People can be trained to sound like other people. Physical things other than the body is something you “have”.
- deleted 4y ago
  [deleted]
Blahah 4y ago
It's "a thing that you are", as opposed to: "a thing that you have": a key, an ID card, security fob, official uniform, etc. "a thing that you know": a password, PIN, the answer to a secret question, secret handshake, etc.

jbaczuk 4y ago

"biometrics"

blitzar 4y ago

My Voice Is My Passport, Verify Me - https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64

dingusdew 4y ago
[dead]
thewebcount 4y ago
This was the first thing I thought of when I read that. I was like, "Is this the author being cheeky and not really saying what the phrase is, or did someone who works for the bank think they were being clever re-using this line that a 30 year old movie shows is super-easy to spoof?"
- vatys 4y ago
  > 30 year old movie It may be a shock but that movie will actually turn 41 this summer. It seems the author has shown that a replicant can trick a bank.
  - Tryk 4y ago
    31*
EGreg 4y ago
This is bad and insecure. Look at this: https://m.youtube.com/watch?v=rERApU26PcA https://m.youtube.com/watch?v=rERApU26PcA Same thing with “pay with your face” they tried in China. They all are susceptible to replay attacks. It is garbage! The only secure way to authorize actions is to have a device in your possession which you unlock with your password and/or biometrics — and use THAT device to sign interactive challenges or ZK-SNARKS. The device could stores keys in a secure enclave, but regardless, the keys should never leave the device. The ability to export private keys (as with ethereum and bitcoin wallets) is insecure, too. Look how 1password does it: local key plus master password. Far better than LastPass (master password only). Also you should have notifications whenever a new device authenticates, or when you are trying to establish new recurring payments at a great rate than you would allow otherwise. Then you need to confirm from other devices. That is the scheme that works universally and the further you depart from that, the more ridiculous hacks you get.
- aziaziazi 4y ago
  > which you unlock with your password and/or biometrics Does this kind of devices really comes in biometric versions ? As someone else mention, unlocking an ATM (or anything else) with a device and your fingerprint is very vulnerable to “steal device and cut finger”.
  - EGreg 4y ago
    Sure. Your iPhone unlocks using your fingerprint or face. But the point is that YOUR iPhone is what’s being unlocked with it — not a machine operated by someone else.
- throwawayapples 4y ago
  agreed with first two sentences. but, "..which you unlock with your password and/or biometrics"? unlocking with biometrics is actually the problem, regardless of where the unlocking takes place. relying on a third-party device that you can't even verify is in the custody of its user as "the only secure way to authorize actions" is highly problematic for similar reasons. and confirming "from other devices" rapidly turns into a user nightmare. the irony in all this is that lengthy, strong, non-reused passwords are actually pretty secure, and they don't require any specialized technology or rely on possessing a device that you just forgot on the airplane seat pocket and is now winging its way toward another country.

hbcondo714 4y ago

Yeah, Vanguard has been using this since 2014: [1] https://www.bogleheads.org/forum/viewtopic.php?t=137530 https://www.bogleheads.org/forum/viewtopic.php?t=137530

Manfred 4y ago

Your voice is a thing that you “are”, up to a certain extent. People can be trained to sound like other people. Physical things other than the body is something you “have”.

deleted 4y ago
[deleted]

Blahah 4y ago

It's "a thing that you are", as opposed to: "a thing that you have": a key, an ID card, security fob, official uniform, etc. "a thing that you know": a password, PIN, the answer to a secret question, secret handshake, etc.