7 ms·

My voice is my passport

31 points by shawndumas 12y ago

drKarl 12y ago
Also in Uplink https://www.youtube.com/watch?v=SoIBS1ffyLc#t=94 https://www.youtube.com/watch?v=SoIBS1ffyLc#t=94
drKarl 12y ago
I'm not sure biometric identification is such a great idea... with fingerprint id, it could make the bad guys have an incentive to chop fingers... Also, a fingerprint can be acquired in other ways and then replicated sintetically. In the same fashion, voice identification doesn't seem to be so secure, since it could also be recorded... and if it were commonly used, there would probably be enough incentive to build on top of current text-to-speech and speech synthetizers, to emulate a voice, given enough sample data.
- lighthazard 12y ago
  Also, what are the chances that someone can have a similar pitch/tone/voice as the password holder? I bet someone with enough incentive could find another like it. ie. Google Glass fiasco where you could say, 'OK Google, porn,' behind people who are wearing Google Glass.
  - spb 12y ago
    A couple nights ago, I said "OK Google" and activated the prompt on my girlfriend's phone, across the room. Voices don't even have to be similar.
    - aetherson 12y ago
      On my Moto X (2014), which has a custom activation phrase (mine is "Excuse me Carson"), I've noticed that my wife can not actually activate it. Other men often can, though. It's not designed to be an authentication feature, of course.
    - kelnos 12y ago
      Google Now doesn't care who says "OK, Google"; it'll (intentionally, I assume) allow anyone to say it. Actual voice identification works in a similar way to how apps like Shazam do: they build a "fingerprint" of your voice. This is why it still works if you have a cold, or for some reason the pitch of your voice changes.
- matthewowen 12y ago
  Although the "chop a finger" tactic might be a worry in some exceptional cases... in the vast majority of cases I think "punch someone in the face until they reveal their password" is a more plausible tactic. It also just doesn't matter for a lot of cases. A lot of the systems people often think of as super important and secure and permanent (like banking) have a fair amount of wiggle room for rollback in the event of fraud/crime/etc, and policies/processes to minimize the extent to which you can carry out irreversible transactions. Security is imperfect, so there's value in a system which is robust to security failure.
- coldcode 12y ago
  See the 3rd Bourne movie - he recorded the guys name on the phone and it opened the safe. Not sure how realistic the quality has to be.
- 6d0debc071 12y ago
  If we assume that someone is giving the pass-phrase they've selected in their voice, then it does make the guess more expensive. Now there are two things to guess: What they sound like saying a particular thing and what that thing is. Of course if you have a secure pass-phrase you're not gaining too much there. It's already very difficult to break. But ho-hum, it's not automatically a terrible idea. Someone could record you saying it, but on the one hand I don't think that you're as much at risk from someone around you recording your password as you are from someone trying to guess it, and on the other this is a vulnerability that other forms of password share too - though I grant with a slightly different recording procedure.
- unsignedint 12y ago
  The problem is that a lot of systems perceives biometric as password, while it really is a user name. Biometric doesn't provide security when there's possibility that people can tamper with it. Like Bruce Schneier says... "The lesson is that biometrics work best if the system can verify that the biometric came from the person at the time of verification. The biometric identification system at the gates of the CIA headquarters works because there's a guard with a large gun making sure no one is trying to fool the system."[1] [1] https://www.schneier.com/blog/archives/2009/01/biometrics.html https://www.schneier.com/blog/archives/2009/01/biometrics.ht...
godber 12y ago
Of course, just like your fingerprints, your voice is your username and not your password.
- quonn 12y ago
  Hyperbole. Clearly, it's not a username. Touch ID has improved security for most users, precisely because it works more like a password than a username. (We all know it's not as secure as a real password.)
  - wvenable 12y ago
    It's just a really long, complex, and hard to copy username. In many cases, that is much better than a username/password combination. But it's still just something you are/have and not something you know.
- spb 12y ago
  Passport.
btilly 12y ago
There is one problem with this approach. I have a pretty severe cold today. My voice is unrecognizable. But I can still remember a password.
- sprkyco 12y ago
  This could also be said about passwords: I have bad memory I can't remember a long complex password.. Point being that there are issues with all forms of security. Bullet proof glass for example can be taken out by an RPG this reasoning is only detrimental to the advancement, innovation, and implementation of layers of security to protect consumers. I think it's neat and my take a way from the article is that the author felt comforted by the fact that at least someone at the bank appreciated the movie sneakers and was attempting to increase security measures through innovation.
- zomgbbq 12y ago
  I've used voice authentication with Nuance's SDK before and having a cold or gaining weight does not affect the verification process. It is based on acoustioc signatures in your voice and not necessarily a precise recreation of the original recording. This isn't a problem with this approach.
- Adaptive 12y ago
  Also predicted in the movie 'The Fly' where Goldblum's character fails the voice recognition during his transformation. All future technology has, apparently, been predicted by 1980/90s sci fi.
shawndumas 12y ago
BTW: His main point is, "the best part is that clearly someone at the vast institution that is my bank—someone in a position of some authority no less—is a nerd." His main point is not that it will be fast/secure/good.
- JoblessWonder 12y ago
  Yeah... I was hoping there were going to be some comments about how other people loved the movie Sneakers.[1] Sigh. [1] https://www.youtube.com/watch?v=G_XRqJV2zdk https://www.youtube.com/watch?v=G_XRqJV2zdk
testtest23 12y ago
This reminds me of a PhoneLosers Podcast where he pulls the exact sneakers scheme to get into a Bell Canada account. http://www.phonelosers.org/2008/05/pla-radio-episode-17-voice-authentication/ http://www.phonelosers.org/2008/05/pla-radio-episode-17-voic... That was in 2008.
cgy1 12y ago
Mac OS 9 had a voice login option. In my experience, it did not work very well because my voice when I first woke up in the morning was very different from my voice later on during the day, such that my Mac did not recognize my early morning voice when I tried to log in. e: and yes, I believe the default phrase for the voice login option was "my voice is my passport."
- Anechoic 12y ago
  and yes, I believe the default phrase for the voice login option was "my voice is my passport." It was actually "my voice is my password" not "passport."
StavrosK 12y ago
Does anyone know of a way to log into Linux with voice authentication? That could be better than typing my password all the time.
- ryan-c 12y ago
  I don't know of one, but using PAM to add auth methods is actually pretty easy.
ebertx 12y ago
Verify me.
crashdev 12y ago
Hmm. This the same biometric login routine used by USAA for their mobile apps. Curious to know who actually built it, is it being used under license or is it delivered as a service. Anyone have info?
- extrapolate 12y ago
  It is the same routine, because he is describing the USAA iPhone mobile app :)
- strictnein 12y ago
  This is from the USAA mobile app.
rabbyte 12y ago
Fingerprint, iris, and voice are identifiers not authenticators. Their perceived security comes from their perceived scarcity and difficulty in emulating their presence, barriers that are being removed as technology gets better. In the future the device will know who you are identified as by detecting these markers but you'll still need to prove you are who you are presenting yourself to be.
- jakobegger 12y ago
  Fingerprints are still a better authenticator than a 4 digit passcode in practice. Nothing is infallible, it just needs to be good enough. Biometric security things can be very good at preventing 99% of the problems with 1% of the effort.
  - LunaSea 12y ago
    Biometrics is horrendous as a single point of identification in security systems. Fingerprints and a password, sure, but fingerprints only is the worst idea possible.
    - jakobegger 12y ago
      I disagree. Yes, fingerprints can be faked. But it is much harder to fake a fingerprint than to discover a passcode of a casual user by just watching them type it. I'm absolutely sure that a much smaller percentage of fingerprint protected phones are accessed by unauthorized persons than passcode or password protected phones.
      - LunaSea 12y ago
        Actually it's not, if you have the physical device you more or less already cracked the fingerprint scanner. You could also be compromised by your glass in a bar, a handshake, the door handle of your car or your house. Passwords can be changed but you can't change a finger so this sums up why fingerprints are shit.
psp 12y ago
Sneakers - one of the best computer movies when I was a kid. I used to watch it over and over again. Good times. Must go find it somewhere. That movie probably had an impact on actually getting into the business later on.
- jason_slack 12y ago
  I loved this movie and I still watch it a few times a month as I am working on other things. Sometimes listening to movies provides me more focus than random music from my playlists.
  - fit2rule 12y ago
    I'm the same way - for me, "Bladerunner", "Barbarella" and "Flash Gordon" are on auto-repeat as my background noise for serious coding sessions. For some reason these 3 movies just work so well in that sense .. /off-topic

31 points by shawndumas 12y ago

Also in Uplink https://www.youtube.com/watch?v=SoIBS1ffyLc#t=94 https://www.youtube.com/watch?v=SoIBS1ffyLc#t=94

I'm not sure biometric identification is such a great idea... with fingerprint id, it could make the bad guys have an incentive to chop fingers... Also, a fingerprint can be acquired in other ways and then replicated sintetically. In the same fashion, voice identification doesn't seem to be so secure, since it could also be recorded... and if it were commonly used, there would probably be enough incentive to build on top of current text-to-speech and speech synthetizers, to emulate a voice, given enough sample data.

lighthazard 12y ago
Also, what are the chances that someone can have a similar pitch/tone/voice as the password holder? I bet someone with enough incentive could find another like it. ie. Google Glass fiasco where you could say, 'OK Google, porn,' behind people who are wearing Google Glass.
- spb 12y ago
  A couple nights ago, I said "OK Google" and activated the prompt on my girlfriend's phone, across the room. Voices don't even have to be similar.
  - aetherson 12y ago
    On my Moto X (2014), which has a custom activation phrase (mine is "Excuse me Carson"), I've noticed that my wife can not actually activate it. Other men often can, though. It's not designed to be an authentication feature, of course.
  - kelnos 12y ago
    Google Now doesn't care who says "OK, Google"; it'll (intentionally, I assume) allow anyone to say it. Actual voice identification works in a similar way to how apps like Shazam do: they build a "fingerprint" of your voice. This is why it still works if you have a cold, or for some reason the pitch of your voice changes.
matthewowen 12y ago
Although the "chop a finger" tactic might be a worry in some exceptional cases... in the vast majority of cases I think "punch someone in the face until they reveal their password" is a more plausible tactic. It also just doesn't matter for a lot of cases. A lot of the systems people often think of as super important and secure and permanent (like banking) have a fair amount of wiggle room for rollback in the event of fraud/crime/etc, and policies/processes to minimize the extent to which you can carry out irreversible transactions. Security is imperfect, so there's value in a system which is robust to security failure.
coldcode 12y ago
See the 3rd Bourne movie - he recorded the guys name on the phone and it opened the safe. Not sure how realistic the quality has to be.
6d0debc071 12y ago
If we assume that someone is giving the pass-phrase they've selected in their voice, then it does make the guess more expensive. Now there are two things to guess: What they sound like saying a particular thing and what that thing is. Of course if you have a secure pass-phrase you're not gaining too much there. It's already very difficult to break. But ho-hum, it's not automatically a terrible idea. Someone could record you saying it, but on the one hand I don't think that you're as much at risk from someone around you recording your password as you are from someone trying to guess it, and on the other this is a vulnerability that other forms of password share too - though I grant with a slightly different recording procedure.
unsignedint 12y ago
The problem is that a lot of systems perceives biometric as password, while it really is a user name. Biometric doesn't provide security when there's possibility that people can tamper with it. Like Bruce Schneier says... "The lesson is that biometrics work best if the system can verify that the biometric came from the person at the time of verification. The biometric identification system at the gates of the CIA headquarters works because there's a guard with a large gun making sure no one is trying to fool the system."[1] [1] https://www.schneier.com/blog/archives/2009/01/biometrics.html https://www.schneier.com/blog/archives/2009/01/biometrics.ht...

godber 12y ago

Of course, just like your fingerprints, your voice is your username and not your password.

quonn 12y ago
Hyperbole. Clearly, it's not a username. Touch ID has improved security for most users, precisely because it works more like a password than a username. (We all know it's not as secure as a real password.)
- wvenable 12y ago
  It's just a really long, complex, and hard to copy username. In many cases, that is much better than a username/password combination. But it's still just something you are/have and not something you know.
spb 12y ago
Passport.

btilly 12y ago

There is one problem with this approach. I have a pretty severe cold today. My voice is unrecognizable. But I can still remember a password.

sprkyco 12y ago
This could also be said about passwords: I have bad memory I can't remember a long complex password.. Point being that there are issues with all forms of security. Bullet proof glass for example can be taken out by an RPG this reasoning is only detrimental to the advancement, innovation, and implementation of layers of security to protect consumers. I think it's neat and my take a way from the article is that the author felt comforted by the fact that at least someone at the bank appreciated the movie sneakers and was attempting to increase security measures through innovation.
zomgbbq 12y ago
I've used voice authentication with Nuance's SDK before and having a cold or gaining weight does not affect the verification process. It is based on acoustioc signatures in your voice and not necessarily a precise recreation of the original recording. This isn't a problem with this approach.
Adaptive 12y ago
Also predicted in the movie 'The Fly' where Goldblum's character fails the voice recognition during his transformation. All future technology has, apparently, been predicted by 1980/90s sci fi.

shawndumas 12y ago

BTW: His main point is, "the best part is that clearly someone at the vast institution that is my bank—someone in a position of some authority no less—is a nerd." His main point is not that it will be fast/secure/good.

JoblessWonder 12y ago
Yeah... I was hoping there were going to be some comments about how other people loved the movie Sneakers.[1] Sigh. [1] https://www.youtube.com/watch?v=G_XRqJV2zdk https://www.youtube.com/watch?v=G_XRqJV2zdk

testtest23 12y ago

This reminds me of a PhoneLosers Podcast where he pulls the exact sneakers scheme to get into a Bell Canada account. http://www.phonelosers.org/2008/05/pla-radio-episode-17-voice-authentication/ http://www.phonelosers.org/2008/05/pla-radio-episode-17-voic... That was in 2008.

cgy1 12y ago

Mac OS 9 had a voice login option. In my experience, it did not work very well because my voice when I first woke up in the morning was very different from my voice later on during the day, such that my Mac did not recognize my early morning voice when I tried to log in. e: and yes, I believe the default phrase for the voice login option was "my voice is my passport."

Anechoic 12y ago
and yes, I believe the default phrase for the voice login option was "my voice is my passport." It was actually "my voice is my password" not "passport."

StavrosK 12y ago

Does anyone know of a way to log into Linux with voice authentication? That could be better than typing my password all the time.

ryan-c 12y ago
I don't know of one, but using PAM to add auth methods is actually pretty easy.

ebertx 12y ago

Verify me.

crashdev 12y ago

Hmm. This the same biometric login routine used by USAA for their mobile apps. Curious to know who actually built it, is it being used under license or is it delivered as a service. Anyone have info?

extrapolate 12y ago
It is the same routine, because he is describing the USAA iPhone mobile app :)
strictnein 12y ago
This is from the USAA mobile app.

rabbyte 12y ago

Fingerprint, iris, and voice are identifiers not authenticators. Their perceived security comes from their perceived scarcity and difficulty in emulating their presence, barriers that are being removed as technology gets better. In the future the device will know who you are identified as by detecting these markers but you'll still need to prove you are who you are presenting yourself to be.

jakobegger 12y ago
Fingerprints are still a better authenticator than a 4 digit passcode in practice. Nothing is infallible, it just needs to be good enough. Biometric security things can be very good at preventing 99% of the problems with 1% of the effort.
- LunaSea 12y ago
  Biometrics is horrendous as a single point of identification in security systems. Fingerprints and a password, sure, but fingerprints only is the worst idea possible.
  - jakobegger 12y ago
    I disagree. Yes, fingerprints can be faked. But it is much harder to fake a fingerprint than to discover a passcode of a casual user by just watching them type it. I'm absolutely sure that a much smaller percentage of fingerprint protected phones are accessed by unauthorized persons than passcode or password protected phones.
    - LunaSea 12y ago
      Actually it's not, if you have the physical device you more or less already cracked the fingerprint scanner. You could also be compromised by your glass in a bar, a handshake, the door handle of your car or your house. Passwords can be changed but you can't change a finger so this sums up why fingerprints are shit.

psp 12y ago

Sneakers - one of the best computer movies when I was a kid. I used to watch it over and over again. Good times. Must go find it somewhere. That movie probably had an impact on actually getting into the business later on.

jason_slack 12y ago
I loved this movie and I still watch it a few times a month as I am working on other things. Sometimes listening to movies provides me more focus than random music from my playlists.
- fit2rule 12y ago
  I'm the same way - for me, "Bladerunner", "Barbarella" and "Flash Gordon" are on auto-repeat as my background noise for serious coding sessions. For some reason these 3 movies just work so well in that sense .. /off-topic