5 ms·

And it's only going to get faster, better, easier, cheaper.[a] Meanwhile, yesterday my credit card company asked me if I wanted to use voice authentication for

• user_7832 3y ago
  > Is every single executive and manager at my credit card company completely unaware that right now anyone can clone anyone else's voice by obtaining a short sample audio clip taken from any social network? Your mistake is assuming the company cares. The "company" is a hundred different disjointed departments that only care about not getting caught Equifax-style (or filing for bankruptcy if caught). If the marketing director sees a shiny new thing that might boost some random KPI they may not really care about security. However in the rare chance that your bank is actually half decent, I'd suggest contacting their IT/Security teams about your concerns. Maybe you'll save some folks from getting scammed?
  • cyanydeez 3y ago
    Also, this feature is probably just some midd level execs plan for a bonus, not a rigorously reviewed and planned. It's also probably in the pipeline for a decade so if they don't push it out, suddenly they get no bonus for cancelling a project. Corporations are ultimately no better than governments and likely worse depending on what their regulatory environment looks like.
    • iamflimflam1 3y ago
      There’s a really important thing here for anyone trying to do sales to big companies. Find an exec that needs a project to advance their career. Make your software that project. Suck in as many other execs into the project so their careers become coupled to getting your software rolled out.
      • amindeed 3y ago
        That's clever!
  • b3yondtopsecret 3y ago
    [dead]
• fragmede 3y ago
  I mean, what do you want them to do? If we think their security officers are freaking out and holding meetings right now about what to do, or if they're asleep at the wheel, we'd be seeing the same thing from the outside, no?
  • addandsubtract 3y ago
    No, because multiple companies are pushing this atm. If it was only company I would agree, but with multiple, you'd have at least one that would back out of it again.
• ryandrake 3y ago
  Any time you add a "new" security gate to your product, it should be in addition to and not instead of the existing gates. Biometrics should not replace username/password, they should be in addition to. Security Questions like "What was your first pet's name" should not be able to get you in the backdoor. SMS verification alone should not allow you to reset your password. Same with this voice authentication stuff. It should be another layer, not a replacement of your actual credentials. If you treat it as OR instead of AND, then your security is only as good as the worst link in the chain.
  • recursive 3y ago
    If you make your product sufficiently inconvenient, then you'll have the unassailable security posture of having no users.
• supercheetah 3y ago
  That scene from Sneakers would be so different nowadays. [1] "My voice is my passport. Verify me." [2] 1. https://youtu.be/WdcIqFOc2UE?si=Df3DtSakatp9eD0L https://youtu.be/WdcIqFOc2UE?si=Df3DtSakatp9eD0L 2. https://youtu.be/-zVgWpVXb64?si=yT2GZpb7E2yZoEYl https://youtu.be/-zVgWpVXb64?si=yT2GZpb7E2yZoEYl
• deleted 3y ago
  [deleted]
• dade_ 3y ago
  Yes, they are and they also know it isn't foolproof so that isn't the only information being compared against. Some services compare the calling number is compared against live activity on the PSTN (ie, subscriber's phone is not in an active call, but their number is being presented as as the caller ID is one such metric). Many of these deep fake generators with public access have watermarks in the audio. The audio stream comparison continues, it needs to speak like you, word and phrase choices. There are other fingerprints of generated audio that you can't hear, but are still obvious at the moment. With security, it always cat and mouse with fraudsters on one hand and the effort/frustration with customers on the other. Asking customers questions that they don't remember and that fraudsters have in front of them isn't working and the time it takes for agents to authenticate is very expensive. While there is no doubt that companies will screw up with security, you are making wild accusations without reference to any evidence.
• stubish 3y ago
  The point is lowering liability. By choosing to not use voice authentication (or whatever), it becomes easier to argue that fraud is your fault. Or if you did use it, the company 'is doing everything they can' and 'exceeding industry standards' so it isn't their fault, either. It also just makes them seem more secure to the uninitiated (the security-theater bit, yes). Maybe one day someone will successfully argue that adding easily defeated checks lowers security, by adding friction for no reason or instilling false confidence in users at both ends.
• tennisflyi 3y ago
  Pretty much. You think they’re smart or with it. They’re just lucky fogies