3 ms·

My Voice Is My Passport, Verify Me - https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64

dingusdew 4y ago
[dead]
thewebcount 4y ago
This was the first thing I thought of when I read that. I was like, "Is this the author being cheeky and not really saying what the phrase is, or did someone who works for the bank think they were being clever re-using this line that a 30 year old movie shows is super-easy to spoof?"
- vatys 4y ago
  > 30 year old movie It may be a shock but that movie will actually turn 41 this summer. It seems the author has shown that a replicant can trick a bank.
  - Tryk 4y ago
    31*
EGreg 4y ago
This is bad and insecure. Look at this: https://m.youtube.com/watch?v=rERApU26PcA https://m.youtube.com/watch?v=rERApU26PcA Same thing with “pay with your face” they tried in China. They all are susceptible to replay attacks. It is garbage! The only secure way to authorize actions is to have a device in your possession which you unlock with your password and/or biometrics — and use THAT device to sign interactive challenges or ZK-SNARKS. The device could stores keys in a secure enclave, but regardless, the keys should never leave the device. The ability to export private keys (as with ethereum and bitcoin wallets) is insecure, too. Look how 1password does it: local key plus master password. Far better than LastPass (master password only). Also you should have notifications whenever a new device authenticates, or when you are trying to establish new recurring payments at a great rate than you would allow otherwise. Then you need to confirm from other devices. That is the scheme that works universally and the further you depart from that, the more ridiculous hacks you get.
- aziaziazi 4y ago
  > which you unlock with your password and/or biometrics Does this kind of devices really comes in biometric versions ? As someone else mention, unlocking an ATM (or anything else) with a device and your fingerprint is very vulnerable to “steal device and cut finger”.
  - EGreg 4y ago
    Sure. Your iPhone unlocks using your fingerprint or face. But the point is that YOUR iPhone is what’s being unlocked with it — not a machine operated by someone else.
- throwawayapples 4y ago
  agreed with first two sentences. but, "..which you unlock with your password and/or biometrics"? unlocking with biometrics is actually the problem, regardless of where the unlocking takes place. relying on a third-party device that you can't even verify is in the custody of its user as "the only secure way to authorize actions" is highly problematic for similar reasons. and confirming "from other devices" rapidly turns into a user nightmare. the irony in all this is that lengthy, strong, non-reused passwords are actually pretty secure, and they don't require any specialized technology or rely on possessing a device that you just forgot on the airplane seat pocket and is now winging its way toward another country.
  - EGreg 4y ago
    Not necessarily. As long as the device is YOURS, you can unlock it with your face, thumbprint etc. That is how iPhones and Android security has been managed for a long time. Perhaps to unlock even more valuable transactions, you’d want to bring an external key, like a Yubikey or Ledger Nano wallet etc. Lengthy passwords that you enter are not very secure. Anyone can capture your keystrokes, look over your shoulder with a camera, or even look at heat signatures on your phone after you left to the bathroom and locked it: https://www.zdnet.com/google-amp/article/this-thermal-attack-can-read-your-password-from-the-heat-your-fingertips-leave-behind/ https://www.zdnet.com/google-amp/article/this-thermal-attack...

dingusdew 4y ago

[dead]

thewebcount 4y ago

This was the first thing I thought of when I read that. I was like, "Is this the author being cheeky and not really saying what the phrase is, or did someone who works for the bank think they were being clever re-using this line that a 30 year old movie shows is super-easy to spoof?"

vatys 4y ago
> 30 year old movie It may be a shock but that movie will actually turn 41 this summer. It seems the author has shown that a replicant can trick a bank.
- Tryk 4y ago
  31*

EGreg 4y ago

This is bad and insecure. Look at this: https://m.youtube.com/watch?v=rERApU26PcA https://m.youtube.com/watch?v=rERApU26PcA Same thing with “pay with your face” they tried in China. They all are susceptible to replay attacks. It is garbage! The only secure way to authorize actions is to have a device in your possession which you unlock with your password and/or biometrics — and use THAT device to sign interactive challenges or ZK-SNARKS. The device could stores keys in a secure enclave, but regardless, the keys should never leave the device. The ability to export private keys (as with ethereum and bitcoin wallets) is insecure, too. Look how 1password does it: local key plus master password. Far better than LastPass (master password only). Also you should have notifications whenever a new device authenticates, or when you are trying to establish new recurring payments at a great rate than you would allow otherwise. Then you need to confirm from other devices. That is the scheme that works universally and the further you depart from that, the more ridiculous hacks you get.

aziaziazi 4y ago
> which you unlock with your password and/or biometrics Does this kind of devices really comes in biometric versions ? As someone else mention, unlocking an ATM (or anything else) with a device and your fingerprint is very vulnerable to “steal device and cut finger”.
- EGreg 4y ago
  Sure. Your iPhone unlocks using your fingerprint or face. But the point is that YOUR iPhone is what’s being unlocked with it — not a machine operated by someone else.
throwawayapples 4y ago
agreed with first two sentences. but, "..which you unlock with your password and/or biometrics"? unlocking with biometrics is actually the problem, regardless of where the unlocking takes place. relying on a third-party device that you can't even verify is in the custody of its user as "the only secure way to authorize actions" is highly problematic for similar reasons. and confirming "from other devices" rapidly turns into a user nightmare. the irony in all this is that lengthy, strong, non-reused passwords are actually pretty secure, and they don't require any specialized technology or rely on possessing a device that you just forgot on the airplane seat pocket and is now winging its way toward another country.
- EGreg 4y ago
  Not necessarily. As long as the device is YOURS, you can unlock it with your face, thumbprint etc. That is how iPhones and Android security has been managed for a long time. Perhaps to unlock even more valuable transactions, you’d want to bring an external key, like a Yubikey or Ledger Nano wallet etc. Lengthy passwords that you enter are not very secure. Anyone can capture your keystrokes, look over your shoulder with a camera, or even look at heat signatures on your phone after you left to the bathroom and locked it: https://www.zdnet.com/google-amp/article/this-thermal-attack-can-read-your-password-from-the-heat-your-fingertips-leave-behind/ https://www.zdnet.com/google-amp/article/this-thermal-attack...