5 ms·

I'm not sure biometric identification is such a great idea... with fingerprint id, it could make the bad guys have an incentive to chop fingers... Also, a finge

by drKarl 12y ago

I'm not sure biometric identification is such a great idea... with fingerprint id, it could make the bad guys have an incentive to chop fingers... Also, a fingerprint can be acquired in other ways and then replicated sintetically. In the same fashion, voice identification doesn't seem to be so secure, since it could also be recorded... and if it were commonly used, there would probably be enough incentive to build on top of current text-to-speech and speech synthetizers, to emulate a voice, given enough sample data.

lighthazard 12y ago
Also, what are the chances that someone can have a similar pitch/tone/voice as the password holder? I bet someone with enough incentive could find another like it. ie. Google Glass fiasco where you could say, 'OK Google, porn,' behind people who are wearing Google Glass.
- spb 12y ago
  A couple nights ago, I said "OK Google" and activated the prompt on my girlfriend's phone, across the room. Voices don't even have to be similar.
  - aetherson 12y ago
    On my Moto X (2014), which has a custom activation phrase (mine is "Excuse me Carson"), I've noticed that my wife can not actually activate it. Other men often can, though. It's not designed to be an authentication feature, of course.
  - kelnos 12y ago
    Google Now doesn't care who says "OK, Google"; it'll (intentionally, I assume) allow anyone to say it. Actual voice identification works in a similar way to how apps like Shazam do: they build a "fingerprint" of your voice. This is why it still works if you have a cold, or for some reason the pitch of your voice changes.
matthewowen 12y ago
Although the "chop a finger" tactic might be a worry in some exceptional cases... in the vast majority of cases I think "punch someone in the face until they reveal their password" is a more plausible tactic. It also just doesn't matter for a lot of cases. A lot of the systems people often think of as super important and secure and permanent (like banking) have a fair amount of wiggle room for rollback in the event of fraud/crime/etc, and policies/processes to minimize the extent to which you can carry out irreversible transactions. Security is imperfect, so there's value in a system which is robust to security failure.
coldcode 12y ago
See the 3rd Bourne movie - he recorded the guys name on the phone and it opened the safe. Not sure how realistic the quality has to be.
6d0debc071 12y ago
If we assume that someone is giving the pass-phrase they've selected in their voice, then it does make the guess more expensive. Now there are two things to guess: What they sound like saying a particular thing and what that thing is. Of course if you have a secure pass-phrase you're not gaining too much there. It's already very difficult to break. But ho-hum, it's not automatically a terrible idea. Someone could record you saying it, but on the one hand I don't think that you're as much at risk from someone around you recording your password as you are from someone trying to guess it, and on the other this is a vulnerability that other forms of password share too - though I grant with a slightly different recording procedure.
unsignedint 12y ago
The problem is that a lot of systems perceives biometric as password, while it really is a user name. Biometric doesn't provide security when there's possibility that people can tamper with it. Like Bruce Schneier says... "The lesson is that biometrics work best if the system can verify that the biometric came from the person at the time of verification. The biometric identification system at the gates of the CIA headquarters works because there's a guard with a large gun making sure no one is trying to fool the system."[1] [1] https://www.schneier.com/blog/archives/2009/01/biometrics.html https://www.schneier.com/blog/archives/2009/01/biometrics.ht...

by drKarl 12y ago

lighthazard 12y ago

Also, what are the chances that someone can have a similar pitch/tone/voice as the password holder? I bet someone with enough incentive could find another like it. ie. Google Glass fiasco where you could say, 'OK Google, porn,' behind people who are wearing Google Glass.

spb 12y ago
A couple nights ago, I said "OK Google" and activated the prompt on my girlfriend's phone, across the room. Voices don't even have to be similar.
- aetherson 12y ago
  On my Moto X (2014), which has a custom activation phrase (mine is "Excuse me Carson"), I've noticed that my wife can not actually activate it. Other men often can, though. It's not designed to be an authentication feature, of course.
- kelnos 12y ago
  Google Now doesn't care who says "OK, Google"; it'll (intentionally, I assume) allow anyone to say it. Actual voice identification works in a similar way to how apps like Shazam do: they build a "fingerprint" of your voice. This is why it still works if you have a cold, or for some reason the pitch of your voice changes.

matthewowen 12y ago

Although the "chop a finger" tactic might be a worry in some exceptional cases... in the vast majority of cases I think "punch someone in the face until they reveal their password" is a more plausible tactic. It also just doesn't matter for a lot of cases. A lot of the systems people often think of as super important and secure and permanent (like banking) have a fair amount of wiggle room for rollback in the event of fraud/crime/etc, and policies/processes to minimize the extent to which you can carry out irreversible transactions. Security is imperfect, so there's value in a system which is robust to security failure.

coldcode 12y ago

See the 3rd Bourne movie - he recorded the guys name on the phone and it opened the safe. Not sure how realistic the quality has to be.

6d0debc071 12y ago

If we assume that someone is giving the pass-phrase they've selected in their voice, then it does make the guess more expensive. Now there are two things to guess: What they sound like saying a particular thing and what that thing is. Of course if you have a secure pass-phrase you're not gaining too much there. It's already very difficult to break. But ho-hum, it's not automatically a terrible idea. Someone could record you saying it, but on the one hand I don't think that you're as much at risk from someone around you recording your password as you are from someone trying to guess it, and on the other this is a vulnerability that other forms of password share too - though I grant with a slightly different recording procedure.

unsignedint 12y ago

The problem is that a lot of systems perceives biometric as password, while it really is a user name. Biometric doesn't provide security when there's possibility that people can tamper with it. Like Bruce Schneier says... "The lesson is that biometrics work best if the system can verify that the biometric came from the person at the time of verification. The biometric identification system at the gates of the CIA headquarters works because there's a guard with a large gun making sure no one is trying to fool the system."[1] [1] https://www.schneier.com/blog/archives/2009/01/biometrics.html https://www.schneier.com/blog/archives/2009/01/biometrics.ht...