Slashdot Mirror
Should Brokers Use 'Voice Prints' For Stock Transactions? (cnbc.com)
Fidelity and Charles Schwab now allow traders to use "voice prints" to authorize stock transactions. But there's more to the story, argues long-time Slashdot reader maiden_taiwan:
Fidelity Investments is touting its new security feature, MyVoice, which allows a customer to access his/her financial accounts by telephone without a password. "When you call Fidelity, you'll no longer have to enter PINs or passwords because Fidelity MyVoice helps you interact with us securely and more conveniently. Through natural conversation, MyVoice will detect and verify your voiceprint in the first few moments of the call... Fidelity MyVoice performs even if you have a cold, allergies, or a sore throat."
Based on my own experience, Fidelity now enables MyVoice automatically for its customers who call in for other reasons. Apparently, their conversation with Fidelity customer service provides enough data for MyVoice to recognize them. (Customers are informed afterward that MyVoice has been enabled, and they can opt out, although they aren't told that opting out is possible.)
It's not clear whether Fidelity is creating voice profiles of their customers without asking first. (Fidelity's site says only that their representatives will "offer" to enroll you the next time you call.) But the original submission ends with two more questions. "In an era where Apple's face recognition is easily defeated by family members, is voice recognition any more secure?"
And "Is a 'voiceprint' even possible?"
Based on my own experience, Fidelity now enables MyVoice automatically for its customers who call in for other reasons. Apparently, their conversation with Fidelity customer service provides enough data for MyVoice to recognize them. (Customers are informed afterward that MyVoice has been enabled, and they can opt out, although they aren't told that opting out is possible.)
It's not clear whether Fidelity is creating voice profiles of their customers without asking first. (Fidelity's site says only that their representatives will "offer" to enroll you the next time you call.) But the original submission ends with two more questions. "In an era where Apple's face recognition is easily defeated by family members, is voice recognition any more secure?"
And "Is a 'voiceprint' even possible?"
Hi, my name is Werner Brandes. My voice is my passport. Verify Me.
https://www.youtube.com/watch?...
I can't wait to clean out my identical twin's account.
This isn't secure at all. There are at least a couple of problems.
A recording of a person should be able to fool the system. Given that just about everyone uses their voice, they are leaving information behind that could be used to compromise their account. Given enough voice recordings, you could stitch them together to compromise a person's account.
Also, even if you don't have the exact recording you want, given enough samples of a person's voice, you can use a computer to make a recording of a person saying anything. This is how Majel Barrett is the computer voice in Star Trek Discovery despite having passed way years ago. People who speak publicly a lot are providing lots of samples that could be used to compromise their accounts. In principle, if you give a talk and upload it to Youtube, you're posting a sample of your voice online that could potentially be used against you.
This seems even worse than many other biometrics like facial and fingerprint recognition.
Oh goodie! This should be easy!
“He’s not deformed, he’s just drunk!”
Recognising random words with random accents and under random conditions is difficult, but a list of specially-selected words said by the same person might allow to relatively easily and accurately recognise someone. I am not sure regarding their claims of everything working fine even when the person has a cold or similar; same thing when dealing with background noise or low quality sound. In any case, it seems a quite problematic format which, unless being deployed for a very good reason and always used under good conditions, should be avoided.
Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
Blood samples, an ounce or two per transaction should be sufficient.
Oops- I have to make a transaction but I'm hoarse from a cold, or a concert, or a car accident... guess I just go bankrupt.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
as usual.
Especially for HFT!
Whenever a friend or family member calls me, I can recognize their voice even WITHOUT them telling me who it is. So yes, of course it's possible to recognize voices, especially when the person says their name, so you're only confirming yes / no to a particular identity, not trying to figure out who it is.
A few things need to be done to make it more secure than it would be without them. The biggest one is a challenge - they should be prompted to say something they wouldn't predict ahead of time, in order to foil recordings. You could probably get a recording of me saying my nams, "Ray Morris" if you knew ahead of time what you needed me to say, but of the system asks random questions like "where do you work?" it would be tough to have a recording prepared for every possible question.
One should also factor in other indicators such as caller ID and anamoly detection. If the person calls every month and does a $5,000 transaction, the next time they do the same thing is probably legitimate. If they are trying to do something out of the norm, stronger verification is called for. Many weak authenticators combined end up pretty strong, if the weak indicators are reasonably independent.
The problem with telephone anything is that you typically have to say your password aloud within earshot of anyone who is listening, into a device that is easily spied on through a network with known flaws.
It's probably not more secure than FaceID, but that's not the benchmark. The benchmark is a shitty phone password, or god forbid basic details such as your date of birth, your mother's maiden name, and your current address.
"Is a 'voiceprint' even possible?"
Yes, given a standardised high-quality microphone in a controlled, acoustically-neutral environment, directly connected to the analysis system.
However, in the case of audio captured in random-background-noise environments from variable (generally average-to-poor) quality microphones, frequency-constrained and compressed (in the analogue sense) then, in the case of a land-line, pushed down a mile or so of dodgy copper or aluminium before being encoded and compressed (in the digital sense), then punted through a variety of systems before being re-constituted at the receiving end, and then being able to reliably identify one person from another with sufficient accuracy to legally enter into a contract... no.
I think Rory Bremner (substitue your locally-well-known impressionist) is going to become incredibly wealthy.
This sig left unintentionally blank.
I think it was the 1966 movie "The Glass Bottom Boat" which had a voice-activated safe. A portable tape recorder opened it...
> Recognising the voice of someone under random conditions is a quite complex action. There are many things that are extremely simple for you, but extremely difficult for a computer.
It may or may not be *difficult*, but it's definitely *possible*. If anyone has any evidence that this task is particularly difficult for a computer, much more difficult than it is for a human, I'd love ot see that evidence. Or evidence to the contrary. If voice recognition actually is that hard for modern computers, there is an opportunity there to serve humanity and make a lot of money by leveraging that fact.
I heereby authoriiize the purchasse of 50 Billion Dollarrrs wörth of stöck from theee Amazingleee Reliabble Inveeestment Fünd of Lagosss, Nigeriaaa. Pleaase sendd they möney in unmarkked fifteee Döllarr billls to P.O. Box 65631 att one-theee-five Revolütiön Röad in Lagoss Nigeeeria.
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
Apparently people still talk to brokers to initiate stock trades.
I am a Fidelity customer. I received a mailing from Fidelity describing the My Voice feature but it said I had to call in and specifically request that it be enabled. Fidelity is NOT enabling it by default for customers, at least based on what I can see.
However, this is not entirely a seamless experience. When you call in, you still have to enter your username or SSN using the phone keypad (for a username, you press the digit the letter is on, case doesn't matter, and * for special characters. Without My Voice, you also enter your password this way! Since I have a strong, unique password I ended up creating a note in LastPass with the keys to press.) Then you have to speak to have it detect your voice. I was told I could unenroll at any time.
I'm not exactly thrilled with voice being the authentication mechanism, but it's better than what they had before. Fidelity, at least, doesn't use 2FA for typical operations; their web site says they may ask for it (a code sent by SMS, I'd guess) for certain transactions, but they've never asked me for this in the past.
The start up mentioned in the Verge story may or may not develop a usable product, but in my experience Verge is slightly less reliable than National Enquirer. For example, the last two network neutrality stories posted here in the last few days have been from Verge, and both have been utterly full of shit.
As any biometric system, this uses non revocable public data as authentication credentials.
Once someone manages to fool the system, there is no password change, the whole system must be replaced.
I assume speech impediments are OK.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
It has been decreed that claiming innocence is proof enough of it. How is claiming that you are you any different?
Therefore, there is no need even for a voice print. Just ask them their name and use recognition. Who would lie?
The source was just the first that came up in a Google search for Lyrebird. There are others.
So let me understand this. They want to make your voice your password. Over telephone-quality line transmission. With a big fuzz factor for illness etc.
Hell, anyone with a digital recording device and a few moments to spare with some free audio software is gonna be rich...
Seems a large number of engineers get their ideas of the future by watching Star Trek and they don't realize it was just a TV show with actors and sets and props.
People thus inspired often forget to think things through because the writers of the show did not show the problems in their hour-long dramas.
The voiceprint is one of those ideas that seems so great and futuristic, and seems a perfect solution to security in an automated scheme - but there are numerous problems. First, like many such schemes, the ideal form will not be utilized; managers will demand corner cutting to save money and the voices will not be "printed" with sufficient resolution to guarantee total accuracy. Second, these schemes often overlook the basic fact that a random sampling of real "icky" oozy, dirty, imperfect human meatbags are a vital element and these elements get sick, disabled, drunk, etc. Just how do you make a voicepring scheme that's so bulletproof it will never let the wrong person through, while also being so flexible it can handle any correct person with any of a nearly unlimited number of conditions that alter the voice? How about when a valid user is having radiation treatment for throat cancer and her salivary glands are killed off? How about the person who is having bad allergy problems?
I'm sorry, but a great many new tech product of the past decade or so seem to have been cooked-up by people in their mid-twenties whove never known a sick or handicapped person, and who live in big cities with mass transit and ubiquitous high-speed internet access. Such morons have no real-worl life experience and are too-often caught flat-footed when encountering an ordinary person. I am reminded of the young Obamacare person who was reported several years ago telling an older farmer in the midwest how to sign-up and as part of the instructions asked for the farmer's e-mail address, only to be baffled by the response of "what's 'e-mail'?"
It may or may not be *difficult*, but it's definitely *possible*
I never said that it was impossible. In fact, the whole point of my original post was highlighting that it was easier than it might look like. Current voice recognition software (just recognising each word as a person would do) has lots of limitations; on the other hand, developing an acceptably reliable approach determining whether certain words were said by a given person or not doesn't look too difficult.
Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
These attempts at using a fingerprint, voiceprint, or "faceprint", always seem to be broken. It has to account for both natural variation but not too much or it's easily broken. I'd like to see more use of those random number generator tokens for verification. They are highly secure and seem pretty simple to use.
If reading a number from a tiny screen is too hard then have the token beep out the touch tones with a button press, or put in a USB interface to type it in for the user. If the device used for the transaction has a camera then put the key in view and let the device read the numbers for the user. I know these things can get lost but then so can a lot of things, keep them small so people can put them in a wallet or on a keyring. People lose wallets and keys too but they also tend to keep these things with them and notice quickly when they are missing.
I suspect that hardware tokens are difficult to manage and therefore have a high cost. This cost is most likely what keeps companies from using them more often. At some point the desire for security and the cost of implementation will meet at a point where hardware tokens become attractive. Right?
I am armed because I am free. I am free because I am armed.
"Computer, begin auto-destruct sequence, authorization Picard 4-7 Alpha Tango."
"Computer, Commander Beverly Crusher. Confirm auto-destruct sequence, authorization Crusher 2-2 Beta Charlie."
"Computer, Lieutenant Commander Worf. Confirm auto-destruct sequence, authorization Worf 3-7 Gamma Echo."
There is nothing more useless than a lock with a voiceprint. -- Fourth Doctor, The Invasion of Time.
If you reply, do so only to what I explicitly wrote. If I didn't write it, don't assume or infer it.