4 ms·

Why would anyone use voice recognition to authenticate users? It's too easy to fake.

by zirgs 3y ago

TheFattestNinja 3y ago
Same reason why, at most UK banks, your online credentials (both user and pwd) are case insensitive: it's convenient to the customer. It costs less money to "pay" for the reduced security than it does in attrition causing customer dissatisfaction (which makes them leave), missed transactions, customer support hotline ("I can't login"), etc,
- adrianmsmith 3y ago
  "It costs less" ... and the question is who pays that cost. If customers leave it's bad for the bank, if customers get scammed then the customers lose their money "well you should have protected your identity better, there's nothing we can do". So from the bank's perspective, customers getting scammed doesn't cost them anything.
  - heartbeats 3y ago
    Banks are usually liable for that.
TSiege 3y ago
I've experienced a bank more or less forcing me into accepting it
jruohonen 3y ago
A broader question would be about biometrics in general. It was not too long ago when these were widely promoted, but now with advances in AI these seem to be increasingly an attack vector.
- mrweasel 3y ago
  Biometrics is an inherently bad idea. It seems cool, until it's defeated or compromised and we all need new fingerprints or eye-replacement.
  - jruohonen 3y ago
    I agree. I was merely saying that these were (and still are?) widely promoted even though the various problems were (are) well-known (and now intensified by AI).
  - spazx 3y ago
    Whenever this comes up, my buddy says "biometrics are for usernames, not passwords".
catchnear4321 3y ago
But it is so secure in the movies! It is incredibly convenient. You never take the headset from your ear. Time is money, and those fractions of an cent… It also sounds (no pun intended) high tech. Which sounds secure. Which is often more important than reality.
- mschild 3y ago
  I always found that aspect of Star Trek TNG really weird. They often say their command codes out loud for everyone to hear. In fact, there was an episode where Data was able take over the ship by imitating Picard's voice.
- toss1 3y ago
  IOW: it is good 'security theater'.
- Paul-Craft 3y ago
  "My voice is my password. Verify me." https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64
mrweasel 3y ago
I wonder if you can opt-out of that? You're right that it seems insanely unsafe, my bank have been legally forced to use two factor authentication for more than 10 years.
Spivak 3y ago
Because for low-stakes authentication like "pulling up your account" for the customer service worker it's fine.
justinclift 3y ago
The main Australian government department which handles things like Medicare, social security ("welfare"), etc has the option to use voice recognition, and they promote it. eg printed flyers selling people on the idea, etc. https://www.servicesaustralia.gov.au/create-your-voiceprint https://www.servicesaustralia.gov.au/create-your-voiceprint https://www.itnews.com.au/news/services-australias-voice-biometrics-library-passes-12-million-548364 https://www.itnews.com.au/news/services-australias-voice-bio... Possibly even worse, the Australian Taxation Office (ATO) - our version of the IRS - has been creating voice prints of all callers for the same purpose. https://www.ato.gov.au/General/Online-services/Voice-authentication/ https://www.ato.gov.au/General/Online-services/Voice-authent... And they reportedly ignore caller instructions to opt out. :(

Why would anyone use voice recognition to authenticate users? It's too easy to fake.

by zirgs 3y ago

Why would anyone use voice recognition to authenticate users? It's too easy to fake.

Same reason why, at most UK banks, your online credentials (both user and pwd) are case insensitive: it's convenient to the customer. It costs less money to "pay" for the reduced security than it does in attrition causing customer dissatisfaction (which makes them leave), missed transactions, customer support hotline ("I can't login"), etc,

adrianmsmith 3y ago
"It costs less" ... and the question is who pays that cost. If customers leave it's bad for the bank, if customers get scammed then the customers lose their money "well you should have protected your identity better, there's nothing we can do". So from the bank's perspective, customers getting scammed doesn't cost them anything.
- heartbeats 3y ago
  Banks are usually liable for that.

TSiege 3y ago

I've experienced a bank more or less forcing me into accepting it

jruohonen 3y ago

A broader question would be about biometrics in general. It was not too long ago when these were widely promoted, but now with advances in AI these seem to be increasingly an attack vector.

mrweasel 3y ago
Biometrics is an inherently bad idea. It seems cool, until it's defeated or compromised and we all need new fingerprints or eye-replacement.
- jruohonen 3y ago
  I agree. I was merely saying that these were (and still are?) widely promoted even though the various problems were (are) well-known (and now intensified by AI).
- spazx 3y ago
  Whenever this comes up, my buddy says "biometrics are for usernames, not passwords".

catchnear4321 3y ago

But it is so secure in the movies! It is incredibly convenient. You never take the headset from your ear. Time is money, and those fractions of an cent… It also sounds (no pun intended) high tech. Which sounds secure. Which is often more important than reality.

mschild 3y ago
I always found that aspect of Star Trek TNG really weird. They often say their command codes out loud for everyone to hear. In fact, there was an episode where Data was able take over the ship by imitating Picard's voice.
toss1 3y ago
IOW: it is good 'security theater'.
Paul-Craft 3y ago
"My voice is my password. Verify me." https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64

mrweasel 3y ago

I wonder if you can opt-out of that? You're right that it seems insanely unsafe, my bank have been legally forced to use two factor authentication for more than 10 years.

Spivak 3y ago

Because for low-stakes authentication like "pulling up your account" for the customer service worker it's fine.

justinclift 3y ago

The main Australian government department which handles things like Medicare, social security ("welfare"), etc has the option to use voice recognition, and they promote it. eg printed flyers selling people on the idea, etc. https://www.servicesaustralia.gov.au/create-your-voiceprint https://www.servicesaustralia.gov.au/create-your-voiceprint https://www.itnews.com.au/news/services-australias-voice-biometrics-library-passes-12-million-548364 https://www.itnews.com.au/news/services-australias-voice-bio... Possibly even worse, the Australian Taxation Office (ATO) - our version of the IRS - has been creating voice prints of all callers for the same purpose. https://www.ato.gov.au/General/Online-services/Voice-authentication/ https://www.ato.gov.au/General/Online-services/Voice-authent... And they reportedly ignore caller instructions to opt out. :(