I Broke into a Bank Account with an AI-Generated Voice
vice.com
vice.com
His idea being that your biometric data is not really secret (i.e. in the case of fingerprints or face, it's attached to your body and easily observable), and also that it cannot be changed (easily, with today's technology). If someone gets their hands on your fingerprints or retina scan, you can't "change your password".
His point was that biometrics are really useful for stuff like KYC when you get a bank account (where bank employees can feel pretty sure that they are really scanning your eyeball and not a picture of your eyeball reproduced for the camera), but not such a good idea for stuff like "are you allowed to access this ATM machine?". Also, while identity theft sucks, getting your password stolen is painless, whereas someone chopping off your thumbs to squish them up to an ATM machine is a less pleasant experience.
Signing into an account on a remote server? Probably not. To access the secure enclave on a device that is with you for 100% of your life? Probably fine.
Most houses don't have locks appropriate for bank. Many people do get by with weak passwords in many situations.
But acknowledging the weakness of this sort of security is still important because a given person has to consider the threat they face (activists who may face repressive state should what good and what bad security is still) and because new exploit method can appear.
The notion, however, that a device shall be with you for 100% of your life is not fine at all. It's totally dystopian.
In some cases they are totally appropriate as passwords. For example fingerprints & face recognition for building access.
(And before you say "but someone could copy your fingerprint from a glass and wear a prosthetic mask that looks like you!" think about how you would break into "password" style building security - PINs and access cards.)
If one still finds themself disagreeing with this, consider the difference between what it means to choose a new username and what it means to choose a new face.
Huh, why is that fine for building access? Someone can enter your house by just having a copy of your fingerprints or face data?
Don't imagine that all security has to be mathematically perfect, especially in the real world.
This is not a real distinction if they are physically present and willing to use that level of violence. It reminds me of the password XKCD -- doesn't matter what your password is or how recently it's been changed if they're willing to beat it out of you with a wrench.
No, your voice (like your fingerprint, iris, SSN, passport number, or any other relatively immutable thing) might be your identification or "a thing that you have".
Password is something you choose, you change when you want, and that you shouldn't reveal to anyone.
It may be a shock but that movie will actually turn 41 this summer.
It seems the author has shown that a replicant can trick a bank.
Same thing with “pay with your face” they tried in China. They all are susceptible to replay attacks. It is garbage!
The only secure way to authorize actions is to have a device in your possession which you unlock with your password and/or biometrics — and use THAT device to sign interactive challenges or ZK-SNARKS.
The device could stores keys in a secure enclave, but regardless, the keys should never leave the device. The ability to export private keys (as with ethereum and bitcoin wallets) is insecure, too.
Look how 1password does it: local key plus master password. Far better than LastPass (master password only).
Also you should have notifications whenever a new device authenticates, or when you are trying to establish new recurring payments at a great rate than you would allow otherwise. Then you need to confirm from other devices.
That is the scheme that works universally and the further you depart from that, the more ridiculous hacks you get.
Does this kind of devices really comes in biometric versions ? As someone else mention, unlocking an ATM (or anything else) with a device and your fingerprint is very vulnerable to “steal device and cut finger”.
but, "..which you unlock with your password and/or biometrics"?
unlocking with biometrics is actually the problem, regardless of where the unlocking takes place.
relying on a third-party device that you can't even verify is in the custody of its user as "the only secure way to authorize actions" is highly problematic for similar reasons.
and confirming "from other devices" rapidly turns into a user nightmare.
the irony in all this is that lengthy, strong, non-reused passwords are actually pretty secure, and they don't require any specialized technology or rely on possessing a device that you just forgot on the airplane seat pocket and is now winging its way toward another country.
Perhaps to unlock even more valuable transactions, you’d want to bring an external key, like a Yubikey or Ledger Nano wallet etc.
Lengthy passwords that you enter are not very secure. Anyone can capture your keystrokes, look over your shoulder with a camera, or even look at heat signatures on your phone after you left to the bathroom and locked it: https://www.zdnet.com/google-amp/article/this-thermal-attack...
That's such a naive take on security. Reminds me of "salt shaker vulnerability": https://www.linkedin.com/pulse/hacker-restaurant-alexander-s...
Today, almost any time you use your credit card online in the US, you are susceptible to replay attack. Even PCI-compliant merchant can simply save your payment method for future uses (neither SCA, nor VISA's VAU is being enforced).
What exactly is the attack vector for face payments, if they are not used for P2P payments, only happen in public places with plenty of cameras, and are capped?
Just because it's "possible", doesn't mean it introduces risks that are not acceptable. Sure, you can risk prison time and get a bag of groceries for free. But stealing groceries old-fashioned way is less risky.
ANY biometrics you use to pay can be easily replayed. Whatever function you derive from these biometrics can be executed when you’re not there.
Not to mention that the biometrics themselves can be emulated by a device (eg voice recording) as you see in sci-movies like Minority Report (fake eyes) or that star trek clip.
Sure, for smaller amounts and using copious amounts of “seller beware” chargeback protections, the system can work. And those chargebacks can be good for many things, so that is how our financial system works now.
But if you want to secure thing that are valuable, like elections and many others, then what I described is the optimal solution.
Physical things other than the body is something you “have”.
"a thing that you have": a key, an ID card, security fob, official uniform, etc.
"a thing that you know": a password, PIN, the answer to a secret question, secret handshake, etc.
Woah. I haven't heard about this game in like a decade! Thanks for the nostalgia.
When I watched the "voice is my passport" sequence, I still enjoyed it, but I immediately thought of our recent ability to mimic a voice speaking any sentence, just by supplying a few minutes of training data.
How long until people start recieving voicemails from scammers in their boss's voice? How long until we can filter voices in real time to convert anyone to sound like anyone else? Video is also not that far away. Will I be able to send my AI doppleganger to videocall standups?
On the plus side, it will help enable things like proper double blind interviews, to allow for gender bias free interviews. It will also help anonymity, or people with disabilities.
In an unrelated note, I had forgotten that President Roslin was in it and was such a fox (I'll probably say that about Battlestar in another twenty years after I have aged past her, like I have now caught up to her in Sneakers :-p
It's a pretty simple concept, but people perennially can't figure it out. Or don't care.
So, if you're going to use biometrics, a retina scan on a bank vault might be reasonable, but a web site that does facial recognition with the user's camera is not.
In practice, it's an arms race. Plug some more sensors and hardware enclave on the next smartphone generation and flame up the zero-trust hype and it'll be a while until you can covertly unlock your spouse's phone or steal your flatmates custodied crypto even as a well-funded hacker.
The colletaral damage of individual autonomy as end-user devices, apps, and services are dragged along and slowly becoming the only gateways into the financial system and large parts of the private and public social room is rather quite unfortunate.
If party A (the owner/user) has control of the hardware, there are certain things it enables, like doing what you want with the hardware you paid for.
If party B (the vendor/manufacturer) has control of the hardware, it enables other things like participating in games with stronger anti-cheat mechanisms or quicker authentication when doing a payment.
Some of these things have value to only one party, and some of them might have value to both. You're never going to make everybody happy when values conflict. Plus it gets extra complicated because values vary. Maybe one end user cares less about control and more about convenience, and another end user is the opposite.
Another big problem with biometrics is that if they're "stolen" then you can't revoke them. That said, if you control the hardware and physical environment where the biometrics are used then it's hard to use the stolen biometrics.
I could see a case for going to an office that was approved by the government to verify your biometrics. That way the hardware and physical environment would be controlled. The office could have people verifying that you don't, for example, have fake fingerprints over your real ones.
Then that office could act like a certificate authority and generate a certificate that links your identity to a newly generated public key. Then all authentication would be done using the private key and certificate instead of using the biometrics directly.
In such a case, stolen biometric data wouldn't be useful since it'd be hard to get past physical inspection.
I'd love to see what, if any, evidence they have to back up the claims they're making.
These old comical soundboards of celebrity voices are imperfect as the audio often has different volume levels and subtle background noise, but illustrates the general principle. With an intense enough effort, you can record enough audio from a person to put together a natural conversation. It takes some effort, but is not outside of the technical capabilities for even a smart 14 year old to set this up.
https://www.101soundboards.com/boards/10716-arnold-schwarzen...
Unless these financial security systems have a way to look for very subtle, unnatural gaps in the audio or the consistency of the audio quality, the voice pattern that exists could be a perfect match with this kind of tactic.
The handful of times I've had to contact Fidelity, their customer service has been exceptionally professional. The only annoying part of the process is trying to insert a long password via the phone dialpad to verify my identity. I've been given the suggestion to setup their MyVoice feature, but have resisted setting that up because it seems like there's a possibility it could be bypassed.
And even ignoring that voice ID is insecure, I still think for the amount of complexity going into voice ID, there are much simpler systems that would be just as easy to use. The difficulty of getting someone to enroll their voice into a database can't possibly be lower than the difficulty of getting them to read a code off the back of their card, or to set up a passcode, or to read off an OTP from an app.
Maybe balance checks are trivial enough where someone doesn't care if they get hacked, but it's still weird because there should be a secure login method over the phone that gets used for everything. That there are separate login methods for different operations is weird and probably not good security. Why bisect it?
If the normal login methods are too cumbersome or hard, well... that's another situation that's worth questioning. There are easy login methods for services that are much more secure, why isn't the normal phone authentication using those? Why is it using a method that's so cumbersome that they need a different login method to check bank balance?
The lower friction afforded by the convenience is believed to translate to more dollars, and that’s the primary consideration for them.
I can see various forms of 'man in the middle' attacks taking place with selective conversational interposing allowing an attacker to inject false data into a live conversation between two parties.
Imagine a simple example using caller ID spoofing: Attacker calls two parties and uses stolen voices to establish a reason for the call(as both people will know they did not instigate the conversation, both will need to be convinced that the other party did). Now the conversation is started and has context. Now the attacker can steer the conversation to various topics and selectively invert various factual exchanges or negotiations. Afterwards, both parties will be left with a valid memory of the interaction and, unless they confer on who instigated the call, may have little reason to suspect that sections of the exchange were manipulated.
It’s almost like if the DMV issued IDs with public key cryptography support and maintained a public certificate authority that we would have a much more reliable form of identification… a bank has customers they aim to please. The DMV does not aim to please anyone!
Yet, at the same time, whenever it is brought up people love to engage in contrarian rambles about how it is simply too hard, people will lose their dongles, etc etc. Most phones support NFC communications these days, it's a tap against a phone or reader for verification and so couldn't be easier.
Within 10 years people are going to wonder how we ever lived _without_ this.
There are signs of a trend of people getting rid of their smartphones in favor of dumbphones. (Disclaimer -- I will be doing this when my smartphone dies.) So using them for payment may not, in fact, become ubiquitous.
Even now, just watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment.
> watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment.
It seem more like 50% here in central Norway, perhaps more.
A dumb phone wouldn't do any of that stuff.
Dumb phones still run applications, they're not mechanical devices, at least anymore.
Yes, I wasn't asking about where the app came from. Preinstalled or user-installed doesn't matter.
So what I hear you saying is that the app doesn't need to communicate with anything, either to add/drop accounts or to make payments. Is that correct?
There would probably have to be some way of pairing the device to your account, but there's probably many potential ways it could be done with some theoretical "dumb phone".
So, a feature phone could be used for this. Good to know!
Ah, that clarifies things. Thank you.
Then I can force-wave to pay for goods, go through security checkpoints, etc. People will freak the fuck out about it... but personally I'm 100% for it.
I just have my contact card on it so when I meet people I can have them scan my hand with their phone to give them my number.
- doesn't cost hundred of dollars
- doesn't live track me every seconds
- isn't holding also the rest of my entire life
- isn't a good target for stealing, ceasing or hacking
The wonderful thing about the payment card is that it's just that: a payment card.
It's small, cheap to replace, doesn't require a battery, doesn't share my GPS position at every second, can't show me ads, and if it gets stolen, I don't also lose my entire list of contacts and my browser favorites.
I can easily have many in my pocket, and only use one when I want. If I lose it, I can cancel it quickly, it doesn't affect anything else, and it's swiftly replaced.
It's also super simple to use, yet not that easy to abuse.
The phone is already too many things at once. Too many eggs on the same baskets.
If my phone breaks, I can’t get onto my work network now…
I have been moving more and more things to my smartphone as time goes on. It’s already my 2FA anyway so it will be a major hassle if it’s stolen (but stealing modern smartphone is useless as they can’t be reactivated anyway).
we have highly technical CAs for https that have wild problems. A well functioning PKI system for banking, identity might work - but it needs to actually be well functioning and transparent.
This article focuses specifically on UK security, and I'm not sure what the situation is over there, but in the US digital security around banks is pretty awful. I looked around a while back trying to find an online consumer bank with good reviews that offered 2-factor authentication (real 2-factor authentication, not just SMS). I couldn't find a single one[0].
At best, a couple of banks mentioned that they had their own proprietary authentication apps that I could install. None of them had basic OTP support for something like AndOTP.
I had to fight with my bank for multiple days before I got them to allow me to set up a passcode that they would use to identify me when I called, rather than just relying on basic information that was all made public in the Equifax leak. To their credit, they do actually ask me, but I still wonder if someone tried to impersonate me, would they actually block access or would they bend as soon as the person made a fuss about not knowing the code?
That the response to this from the banks involved is immediately "well, it's just an extra layer, we're getting better and better" -- it's infuriating to read. It's an industry that is not just behind on security, it's actively hostile to people pointing out that it's behind on security.
I guess it should make me feel better that apparently it's not just a US-specific problem? I'm not sure it does though.
----
[0]: Sidenote, if anyone has any good suggestions here, I'd be all ears. I get regularly annoyed at how bad my bank is with notifications around payments, card usage, etc... and how it seems to be both antagonistic to actual security measures like 2FA and in love with security theater like blocking VPN access.
[1] https://www.reddit.com/r/personalfinance/comments/hvvuwl/usi...
Video is also not that far away. Will I be able to send my AI doppleganger to videocall standups?
It will be interesting to see if we have to take extra steps to verify we are on any non-physically present communications. Email is already suspect. Phone calls are next.
On the plus side, it will help enable things like proper double blind interviews, to allow for gender bias free interviews. It will also help anonymity, or people with disabilities.
Phone lines are frequency limited and connections are sometimes poor. Apparently you can fool it with a recording of the target speaker, but what about an computer generated voice? And are the features it's detecting things you could correlate with information you could gather on a subject - age, gender, place of birth - to produce a good enough match for enough people to make automated targeted attacks possible.
But could you make a transaction?
The title is a little sensationalist.
1. They insist on using voice menus that are only ever capable of servicing requests that I can already do online, or don't work because they're jammed up by the same backend issue that their website hits.
2. They try to auto-enroll me in Voice ID despite always going out of my way to demand that feature not be enabled.
3. Use TOTPs sent to SMS instead of any halfway reasonable TOTP/FIDO2 solution.
US Banks are a joke. So much so that I actively root for them to be hacked so a light can be shone on the fact that my god damn Xbox account is far more secure (first line security) than my Bank account (I do realize that Schwab will probably make me whole faster than Microsoft would in the case of some act of God compromise).
Once you realize there are no banks at a consumer level who keep your information private in any way, the idea of privacy in the US becomes a complete joke.
But I'm also grateful my credit union has an online portal that has 2FA with authentication app support and the ability to disable SMS, phone call and email 2FA options.