Slashdot Mirror
Sound-Based Device Authentication Has Many Possibilities (Video)
Imagine a short (audio) squawk, less than one second long, as a secure authentication method for cell phones or other mobile devices. A company called illiri has developed (and has a patent pending on) a method to do exactly that. The company is so new that its website has only been up for a month, and this interview is their first real public announcement of what they're up to. They envision data sent as sound as a way to facilitate social media, mobile payments (initially with Bitcoin), gaming, and secure logins. Couldn't it also be used for "rebel" communications, possibly by a group of insurgents who want to overthrow the Iranian theocracy? Or even by dissidents in Russia, the country our interviewee, illiri co-founder Vadim Sokolovsky, escaped from? (And yes, "escaped" is his word.) And, considering the way illiri hopes to profit from their work, should they think about open sourcing their work and making their money with services based on their software, along with selling private servers that run it, much the way Sourcefire does in its industry niche? Their APIs are already open, so moving entirely to open source is not a great mental leap for illiri's management. In any case: Is their idea worthwhile? Are there already ways to achieve the same results? Is illliri's way enough better than existing mobile device security systems that it's worth exploring? And would it be better, not just for the world in general, but as a way to help illiri's founders make a living if their software was open source? (Transcript included)
Ok, I'm imagining how stupid this is.
Those who do not learn from Hollywood movies are doomed to repeat them.
I would authenticate with a fart, but, there's so many apps out there... I'm afraid it would be cracked too easily.
Sounds like Blue Box 2.0 to me :)
using sound to send data....sort of like a modem?
-------
1. Enjoy your job
2. Make lots of money
3. Work within the law
Choose any two.
So instead of initiating a digital handshake between two devices, I encode the digital handshake information onto an audio carrier, play it through a speaker, capture it with a microphone, and finally re-encode it back into its original form. Why on earth would I opt for this bizarre technology instead of WiFi, Bluetooth or other low power NFC techniques?
How many question marks is too many in the posting teaser? One? Two? Three? How about seven?
Now that we can identify a wolf howl with 100% accuracy, why not use those instead?
That would make for an awesome login sound for everyone everyday.
I think it's interesting how many alarm bells this post sets off in my head.
First off, it's a long format Slashdot article, and it's not an "ask slashdot" nor a book review. Slashdot TV? is that still a thing? Why are they selling this company?
It reads like an ad and uses the language thereof: "Imagine", "envision", "a way to facilitate", "Initially with Bitcoin",
And.... is that trying to spin the shoddy website as a good thing?
And the format of the video and interview is also just... cheap.
Is their idea worthwhile? Are there already ways to achieve the same results? Is illliri's way enough better than existing mobile device security systems that it's worth exploring? And would it be better, not just for the world in general, but as a way to help illiri's founders make a living if their software was open source?
See Betteridge law of headlines.
Then there's the obvious problem with the basic fundamental gimmick: Anyone with a recorder nearby now has you password. The thing about secrets that are supposed to stay between you and the authenticator is that the transfer point is REALLY important. Pin numbers, passwords and all that jazz are a pain in the ass, but a noise? Anyone with a audio recorder now has your password. If you can put a device up next to their mic, then there are much more secure ways to have your device hand it some information.
This is just so.... so... this is a joke right? Some sort of meta-humor on slashdot?
Since most networks are VoIP now, and a lot of international traffic goes with g729a / 20ms ptime codec, how well would it cope with lossy transcoding and or jitter / packet loss? On the one hand this kind of tech could be really useful for developing countries which aren't very well connected, 3G / Wifi wise (Madagascar, RDC, etc). But on the other hand these countries have _big_ audio issues sometimes so I wonder if some kind of redundancy is built in the protocol to cope with hostiles conditions.
A while back, someone made a system that could go on a credit card that would play what sounded like a brief burst of static. This was used similar to a one-way car remote as a way to have a second authentication factor.
Of course, this might work and needs no additional hardware other than an ADC and DAC that are fairly accurate.
The downside is additional noise pollution. Maybe frequencies that are out of the normal human range can be used, but that narrows the amount of bandwidth the device can use to transmit/receive data with.
Ideally, we should just move to NFC. Using sound is a lowest common denominator type of way to do authentication and key exchanges. It does work, but so does Kermit over a 300 baud modem... we have better protocols and technology at our disposal.
So, it's sound? What's sound, to a computer? A pattern of bytes. What makes this pattern of bytes harder to duplicate/hack than any other pattern of bytes? If I'm following this right, you record a sound, and it's a file on your phone. Someone can steal that file if they could steal any other file. Even more, they can steal it easily when you use it, since the sound will be audible. Isn't this like having to speak your password out loud where anyone can hear it?
If multiple people are using this in a crowded area, how do the audio inputs sort out which sound is the one for the current, active, transaction? Looking for a single sound that fits a given pattern amongst background noise that doesn't seems like a reasonable algorithm to write. Guessing which sound, out of *many* that fit the pattern, is the one you're listening for... that seems a lot harder to me. But i have never written pattern recognition algorithms, or studied them, so I could be way off.
I want to give everyone involved the benefit of the doubt and assume I'll be emitting a "D'oh!" when someone explains to me why this is the best idea since the sliced light bulb. Until someone explains my ignorance to me, I can't shake the feeling that the goal is to excite investors who just see "ground floor buzzword of hot new buzzword with buzzword and also buzzword which buzzwords the buzzword!". Tell me why this isn't the case. Use small words, please. What does this offer no existing technology does? How is it faster, safer, more flexible? Given the long time from announcement to commercial product, how will it compete with other methods that will use that time to be come even more entrenched and leapfrog any improvements this may offer?
Umm...
Remember books? Those heavy, blocky things made up of hundreds of layers of thin sheets of cellulose fibre? With markings, symbols and images on each sheet?
Books have so much information preserved within their covers. That information spans quite a bit of time-space.
Referencing just a couple books...
It looks like all the claims are covered by prior art from all over the world going back at least 100 years.
This had better be some novel, unique integration that no one has ever imagined before or it will be challenged.
gets About 7,290,000 results
I think there is prior art.
All ideas^H^H^H^H^Hprocesses in this post are Patent Pending. (as well as the process of patenting all postings)
Near_sound_data_transfer is already implemented and sold by TagAttitude.
Audio data transfer in Android is discussed in this stackoverflow post which mentions this slideshow.
This dude posted his same idea over a year ago.
Modem-style data transfer between smartphones is a cool idea - but the software and protocol would need to be ubiquitous (read: open). If only a few apps or devices support this tech, it's no different from requiring hardware like NFC or software to support a bluetooth data sharing connection.
...and post on Facebook!
G.
(though it was more fun to light up the carrier detect indicator on old 300 baud modems this way)
Sounds like this: http://www.gizmodo.in/software/NearBytes-is-a-Sound-Based-NFC-like-Data-Transfer-Tech-that-Works-on-Any-Old-or-New-Phone/articleshow/21165630.cms or this: https://itunes.apple.com/us/app/chirp/id529469280?mt=8
A while back, someone made a system that could go on a credit card that would play what sounded like a brief burst of static. This was used similar to a one-way car remote as a way to have a second authentication factor.
Of course, this might work and needs no additional hardware other than an ADC and DAC that are fairly accurate.
The downside is additional noise pollution. Maybe frequencies that are out of the normal human range can be used, but that narrows the amount of bandwidth the device can use to transmit/receive data with.
Ideally, we should just move to NFC. Using sound is a lowest common denominator type of way to do authentication and key exchanges. It does work, but so does Kermit over a 300 baud modem... we have better protocols and technology at our disposal.
Here's my idea: set the tone at a pitch that causes dogs to howl... then encode the information in the dog's howl (after calibration of course), not the original sound. Using a canine as a second factor sounds interesting to me....
Hi, my name is Werner Brandes. My voice is my passport. Verify Me.
http://mobile.slashdot.org/story/11/06/21/003220/sound-based-system-promises-chipless-phone-payment