4 ms·
In this article, the bank used both voice ID and date of birth to verify identity before a balance check. That seems like a reasonable level of security to me.
by elil17 4y ago
In this article, the bank used both voice ID and date of birth to verify identity before a balance check. That seems like a reasonable level of security to me.
- JohnFen 4y agoNot to me. DOB is publicly available information, and I wouldn't even consider using voice as an authentication method. But perhaps that's because I have a fair bit of experience in those voice techs.
- idiotsecant 4y agoFor a balance check? Seems like it's a relatively innocuous piece of information. They aren't transferring money, it's pretty much the same amount of information they would get looking over your shoulder at the ATM.
- JohnFen 4y agoI consider my bank balance to be very sensitive information.
- elil17 4y agoMy point is that they have different levels of authentication required for different levels of access, and the voice id thing seems more reasonable in light of that.
- ncallaway 4y agoDOB???? How can that possibly be considered a useful factor for authentication?
- londons_explore 4y agoYeah, but they use the exact same two forms of auth to send the whole contents of the account overseas... Or to take out a huge loan...
- anigbrowl 4y agoDOB is easy to find and voices are often easy to copy, even without technology. Comedic impressionists have done this for entertainment since about 5 minutes after humans learned to talk.
- isoprophlex 4y agoYeah sure, and if mine should accidentally leak, I'll just change it. No problem there.
- olddustytrail 4y agoSure, as long as you've never had a birthday party in a public place. Or never spoken at it.
- danShumway 4y agoDate of birth is nothing. It's public on your Facebook profile. And even ignoring that voice ID is insecure, I still think for the amount of complexity going into voice ID, there are much simpler systems that would be just as easy to use. The difficulty of getting someone to enroll their voice into a database can't possibly be lower than the difficulty of getting them to read a code off the back of their card, or to set up a passcode, or to read off an OTP from an app. Maybe balance checks are trivial enough where someone doesn't care if they get hacked, but it's still weird because there should be a secure login method over the phone that gets used for everything. That there are separate login methods for different operations is weird and probably not good security. Why bisect it? If the normal login methods are too cumbersome or hard, well... that's another situation that's worth questioning. There are easy login methods for services that are much more secure, why isn't the normal phone authentication using those? Why is it using a method that's so cumbersome that they need a different login method to check bank balance?