3 ms·

Coming to an android and iphone near you voice authentication. Audio streams have inaudible data produced by encrypting a mutually known but changeable token li

Coming to an android and iphone near you voice authentication. Audio streams have inaudible data produced by encrypting a mutually known but changeable token like the current time with your private key embedded in the stream for example in frequencies you can't hear. Your phone app queries the service with the time of call and the data received and if they are also a subscriber it is able to discern their identity with certainty. If this feature is standardized and built in it could be paired with a token like a yubikey which is on users keychain and authenticated even if they were using someone else's phone. All these details can be completely opaque to the user who just needs to see a blue check by calls made with a device verifiably logged in as name@provider and a red exclamation beside calls made with no info at all. Think fake kidnapping scams, industrial espionage, recent attacks involved in pretending to be in HR to redirect corp transfers to attacker. Just a little doubt is liable to blow up such scams.

bee_rider 3y ago
In a fake kidnapping scheme, it doesn’t seem like that much of a stretch to say “I’ve been kidnapped, and they took my keys, so I don’t have my yubikey” or something along those lines.
- michaelmrose 3y ago
  A lot of these scams evaporate like a soap bubble when someone questions it. All it can take is calling the persons phone to verify that they aren't actually kidnapped.
TeMPOraL 3y ago
> If this feature is standardized and built in it could be paired with a token like a yubikey which is on users keychain and authenticated even if they were using someone else's phone. Remember the standard tech bait-and-switch: if this feature is built in, it'll not be good enough to function for purposes you describe, but it will be good enough to track you by your voice for advertising purposes.

bee_rider 3y ago

In a fake kidnapping scheme, it doesn’t seem like that much of a stretch to say “I’ve been kidnapped, and they took my keys, so I don’t have my yubikey” or something along those lines.

michaelmrose 3y ago
A lot of these scams evaporate like a soap bubble when someone questions it. All it can take is calling the persons phone to verify that they aren't actually kidnapped.

TeMPOraL 3y ago

> If this feature is standardized and built in it could be paired with a token like a yubikey which is on users keychain and authenticated even if they were using someone else's phone. Remember the standard tech bait-and-switch: if this feature is built in, it'll not be good enough to function for purposes you describe, but it will be good enough to track you by your voice for advertising purposes.