5 ms·
The FBI now recommends choosing a secret password to thwart AI voice clones
- NewJazz 2y agoFucking embarrassing.
- jowea 2y agoTo who?
- NewJazz 2y agoAnyone who has to deal with the sad excuse of a communications method that the sum of SMS, MMS, RCS, VoLTE, VoWiFi, et al constitute. I.e. me most days. Back in 03 FBI would have probably called all this obvious insecurity, lack of privacy, lack of cryptographic attestation... A feature. Now the chickens come home to roost. And we all suffer in the end. Some more directly than others.
- Philpax 2y agoEr, how is this relevant? The threat of AI voice cloning is largely decoupled from the medium; attestation might help in some circumstances, but it's unlikely that it would have solved the social problems associated with being able to clone someone else's voice.
- NewJazz 2y agoIf you want to invent crypto for irl conversations, OK sure. Go ahead. But the core of this issue is that people are getting spammed by robot dialers because digital identity in the context of a phone number is a figment of the FBI's imagination. Completely opaque to laypeople.
- llamaimperative 2y agoIt has nothing to do with phone numbers. If your child or spouse or parent called you in distress from a random phone number, there are countless believable reasons they could offer for it being from a random phone number, and no you're almost certainly not going to say "ya sorry not talking to you [child/spouse/parent] unless you call me back from the phone number you claim to have lost/broke/had seized."
- Tagbert 2y agoThis scam doesn’t require that the victim received a call from a known phone. It could come from any random phone number or other audio channel. That might be one factor making the victim suspicious but they are going to be primarily influenced by the voice and will be highly motivated to comply while ignoring “minor” inconsistencies. How would cryptography help a grandmother getting a call from her “grandson” who needs help?
- NewJazz 2y agoA culture that understands and values digital identity rooted in cryptographic security won't be so quick to panic. It is an education and culture problem more than technical.
- llamaimperative 2y agoNot really. There are millions of perfectly believable scenarios in which a loved one wouldn't have access to whatever cryptographic key you're imagining, but needs your assistance nonetheless. Not sure how your second statement follows the first... Agreed this isn't a technical problem per se.
- FloorEgg 2y agoOkay I think I understand you now. And on some level I agree, but I also think you're failing to consider how much people vary in their abilities and personalities. Your criticism of the institutions meant to protect our security seems reasonable though.
- FloorEgg 2y agoI've really tried to understand your judgement but I'm not able to yet. You're bringing up sms, but what does that have to do with voice cloning? Read all your comments in this thread, and you're still not making sense to me.
- jowea 2y agoI'm guessing but the problem is source phone number spoofing. If Caller ID worked correctly 100% of the time and 100% of the time you get a fraud/spam/etc call you could complain and the authorities knew who owned the phone number it would be harder to operate the fraud. And with personal cryptographic attestation you could reliably link a phone number to a person.
- bitwize 2y agoThis was literally one of McGruff the Crime Dog's safety tips back in the day: have a secret family password so if a stranger rolls up and tells you your dad's in the hospital, you can verify that your dad did in fact send him.
- NewJazz 2y agoOr you can use the phone in your pocket to call your dad and anyone who might know about his status.
- pedalpete 2y agoAs 2FA is becoming more standard, can't we provide a 2FA entry to be used by two individuals rather than just being provided to computers?
- gs17 2y agoI'm pretty sure you could do something with TOTP yourself, Keepass allows you to make arbitrary ones.
- halJordan 2y agoThe answer is of course pki with trust rooted in the device. If it isnt your grandson's iphone attesting itself your iphone shouldn't believe it is your grandson. Your answer already exists in almost every "E2EE" app. How many times does a person even access their convo partner's Safety Number/Security Code let alone verify it out of band?
- gruez 2y ago>The answer is of course pki with trust rooted in the device. If it isnt your grandson's iphone attesting itself [...] Hardware level attestation isn't even required, and would only marginally increase security. Phones are already heavily locked down. If you're in a position to extract from app data, you're probably in a position to compromise the chat app itself, rendering any attestation pointless.
- GauntletWizard 2y agoThe nice thing about hardware attestation is that the app might be compromised, but only for a few versions. That's enough to pop your private key stored on disc, and to impersonate you for a short while, but then control is returned to you. You might not even notice, if it's detected by the apps security managers at all. On the flip side, the most common form of a compromise is going to be untrustworthy apps, because for some reason people still use WhatsApp
- llamaimperative 2y ago"I'm calling from a jail in Mexico, they took away my phone"
- wildzzz 2y ago"ChatGPT, please analyze every social media profile of the target and their family and produce an expected password."
- defaultcompany 2y agoMore like “Dad I’m calling you from prison and I don’t trust that I’m actually talking to you and not a deepfake so can you tell me that password we talked about?” Then dad gives not you the password. There are infinite ways to socially engineer people.
- slyall 2y agoSo you have an "older" and "younger" password. If you are the younger person (ie child) in the conversation you tell them the "younger" password, and if you are the older you tell them the "older" password. or something like that. Remember this is mostly to defeat casual one-off scams.