4 ms·

I've been working on a prototype to allow authentication via your voice, instead of a types password. You must know the password phrase, and only if if you say

by vauth 12y ago

I've been working on a prototype to allow authentication via your voice, instead of a types password. You must know the password phrase, and only if if you say the phrase will it pass. It isn't infallible, but generally more secure than any typed password. I'm curious, would anybody rather use that vs a typed password? It works via browser (using getUserMedia) or phone call, but the user most enroll first.

harshreality 12y ago
"My voice is my passport, verify me?"
- vauth 12y ago
  Yep, basically. Would you use it?
  - harshreality 12y ago
    Probably not. While any additional factor makes authentication more secure, a voice line allows anyone nearby (or farther away with a unidirectional mic) to compromise that factor. Further, the false negative rate would concern me. What is wrong with TOTP 2-factor?
    - joesmo 12y ago
      "What is wrong with TOTP 2-factor?" Losing your phone effectively locks you out of all your 2-factor accounts. If it's stolen by the wrong people and unlocked/unencrypted, they'll get access to pretty much all of your accounts through a password reset. I'd say that's pretty bad and we have yet to find a good, secure way to authenticate users.
throwwit 12y ago
I'd prefer a discretely input-able password; alongside who ever is stupid enough to attempt to brute force it.
purringmeow 12y ago
How am I going to login if I catch a cold?
zAy0LfpBZLC8mAC 12y ago
How is that more secure than a typed password? (edit: that's not a rhetorical question, though I indeed don't see how it is)
- vauth 12y ago
  I if somebody (or some machine) knows your password, they can use it. Just type it in. Voice authentication, knowing the password is not enough, the right person must say the phrase. Recordings don't work (low signal), and previously used recordings can be detected.
  - zAy0LfpBZLC8mAC 12y ago
    How do you detect previously used recordings such that they can not be altered to be accepted again?
err4nt 12y ago
Unless you're ready to have a conversation with the person and have all the answers to verify in advance, how can you differentiate between a live voice and a recording? It wouldn't be easy for somebody to obtain a recording of my pass phrase, but it's possible. Also, with all the phone related surveillance going on I would rather put money on the fact that my calls HAVE been recorded rather than that they HAVENT been recorded. I know you can encrypt web traffic, but right away the idea of saying something in ~~plaintext~~ plain voice over the phone seems as secure to me as tattooing my email password on my hand. I'm genuinely curious and not trying to shoot your idea down, but those are questions I would need before trusting it with anything more than a 'login of convenience'. I would use it for Skype let's say, but not my email. I might use it for Hacker News but not banking. I had the idea of protecting client websites behind a Twilio-powered login to impress clients, but I never did it. I pictured sitting down with a client, opening a laptop to a giant lock with NO obvious text entry. You press the 'login' button and immediately your phone rings in it's pocket. "alpha forest forty five" and suddenly the lock opens and he page refreshes before their eyes. Now want to see the latest designs we have?
- vauth 12y ago
  >Twilio-powered login to impress clients Sure, would love to see the designs. That is actually a very similar idea, based on two factor authentication. >> but it's possible. Anything is possible.. but if security is your concern, bioauthentication is much more secure than a password. Or proving you are you by.. replying to a text. Anybody could reply to a text, nobody can fake your voice, even if they know your password. Recordings don't generally work (low signal) and are much harder to attain, unless you are the NSA. In which case.. they don't need this anyway. Security isn't the issue.. usability is. You have to enroll, and there are false negatives... and mainly it is just harder to use than typing.

by vauth 12y ago

harshreality 12y ago

"My voice is my passport, verify me?"

vauth 12y ago
Yep, basically. Would you use it?
- harshreality 12y ago
  Probably not. While any additional factor makes authentication more secure, a voice line allows anyone nearby (or farther away with a unidirectional mic) to compromise that factor. Further, the false negative rate would concern me. What is wrong with TOTP 2-factor?
  - joesmo 12y ago
    "What is wrong with TOTP 2-factor?" Losing your phone effectively locks you out of all your 2-factor accounts. If it's stolen by the wrong people and unlocked/unencrypted, they'll get access to pretty much all of your accounts through a password reset. I'd say that's pretty bad and we have yet to find a good, secure way to authenticate users.

throwwit 12y ago

I'd prefer a discretely input-able password; alongside who ever is stupid enough to attempt to brute force it.

purringmeow 12y ago

How am I going to login if I catch a cold?

zAy0LfpBZLC8mAC 12y ago

How is that more secure than a typed password? (edit: that's not a rhetorical question, though I indeed don't see how it is)

vauth 12y ago
I if somebody (or some machine) knows your password, they can use it. Just type it in. Voice authentication, knowing the password is not enough, the right person must say the phrase. Recordings don't work (low signal), and previously used recordings can be detected.
- zAy0LfpBZLC8mAC 12y ago
  How do you detect previously used recordings such that they can not be altered to be accepted again?

err4nt 12y ago

Unless you're ready to have a conversation with the person and have all the answers to verify in advance, how can you differentiate between a live voice and a recording? It wouldn't be easy for somebody to obtain a recording of my pass phrase, but it's possible. Also, with all the phone related surveillance going on I would rather put money on the fact that my calls HAVE been recorded rather than that they HAVENT been recorded. I know you can encrypt web traffic, but right away the idea of saying something in ~~plaintext~~ plain voice over the phone seems as secure to me as tattooing my email password on my hand. I'm genuinely curious and not trying to shoot your idea down, but those are questions I would need before trusting it with anything more than a 'login of convenience'. I would use it for Skype let's say, but not my email. I might use it for Hacker News but not banking. I had the idea of protecting client websites behind a Twilio-powered login to impress clients, but I never did it. I pictured sitting down with a client, opening a laptop to a giant lock with NO obvious text entry. You press the 'login' button and immediately your phone rings in it's pocket. "alpha forest forty five" and suddenly the lock opens and he page refreshes before their eyes. Now want to see the latest designs we have?

vauth 12y ago
>Twilio-powered login to impress clients Sure, would love to see the designs. That is actually a very similar idea, based on two factor authentication. >> but it's possible. Anything is possible.. but if security is your concern, bioauthentication is much more secure than a password. Or proving you are you by.. replying to a text. Anybody could reply to a text, nobody can fake your voice, even if they know your password. Recordings don't generally work (low signal) and are much harder to attain, unless you are the NSA. In which case.. they don't need this anyway. Security isn't the issue.. usability is. You have to enroll, and there are false negatives... and mainly it is just harder to use than typing.