The FBI now recommends choosing a secret password to thwart AI voice clones | Hacker News Reader

The FBI now recommends choosing a secret password to thwart AI voice clones

arstechnica.com

67 pointsperihelions30 comments

As 2FA is becoming more standard, can't we provide a 2FA entry to be used by two individuals rather than just being provided to computers?

I'm pretty sure you could do something with TOTP yourself, Keepass allows you to make arbitrary ones.

The answer is of course pki with trust rooted in the device. If it isnt your grandson's iphone attesting itself your iphone shouldn't believe it is your grandson.

Your answer already exists in almost every "E2EE" app. How many times does a person even access their convo partner's Safety Number/Security Code let alone verify it out of band?

>The answer is of course pki with trust rooted in the device. If it isnt your grandson's iphone attesting itself [...]

Hardware level attestation isn't even required, and would only marginally increase security. Phones are already heavily locked down. If you're in a position to extract from app data, you're probably in a position to compromise the chat app itself, rendering any attestation pointless.

The nice thing about hardware attestation is that the app might be compromised, but only for a few versions. That's enough to pop your private key stored on disc, and to impersonate you for a short while, but then control is returned to you. You might not even notice, if it's detected by the apps security managers at all.

On the flip side, the most common form of a compromise is going to be untrustworthy apps, because for some reason people still use WhatsApp

"I'm calling from a jail in Mexico, they took away my phone"

How would individuals use that?

There are no end of methods using devices to exchange challenge response sequences, but in practical security we have to deal with real people in real contexts. It's why encryption took 30 years to get traction. Passwords already make sense even to a primary school child.

From TFA:

> It's interesting that, in this new age of high-tech AI identity fraud, this ancient invention—a special word or phrase known to few—can still prove so useful.

There are reasons that passwords remain and probably always will be a superior technology [0], and why adding more layers of "solutions" like biometrics and multi-factors actually just increases the attack surface.

[0] https://cybershow.uk/blog/posts/secrets

It starts at home and is not used until required. When I was a child I was taught to say "I love you" on the phone or in person if I was under duress. We had similar processes in the military that were also taught in person or existed in a binder next to the phone. Say one phrase and everything is dandy. Say another phrase and they send in the cavalry.

You're lucky to have good carers. I wonder how many parents or organisations think to give this training?

Haven't read the FBI guidance yet, but it seems they're suggesting we start teaching this outside of professional scope, to everyone.

I think that's a jolly good idea and will be thinking of how to build it into civic cybersecurity syllabus.

Duress signals and a challenge-response for identification are different beasts, but if we're going to teach people verbal signalling to thwart generative scams then may as well teach the whole gamut of craft.

It seems all the responses I'm seeing here are thinking this would be technically handled behind the scenes.

I mean literally, we both open our phones, what is the number that is linking the 2FA between our two devices. Voice authentication of a rotating password.

Fucking embarrassing.

To who?

Anyone who has to deal with the sad excuse of a communications method that the sum of SMS, MMS, RCS, VoLTE, VoWiFi, et al constitute.

I.e. me most days.

Back in 03 FBI would have probably called all this obvious insecurity, lack of privacy, lack of cryptographic attestation... A feature. Now the chickens come home to roost. And we all suffer in the end. Some more directly than others.

Er, how is this relevant? The threat of AI voice cloning is largely decoupled from the medium; attestation might help in some circumstances, but it's unlikely that it would have solved the social problems associated with being able to clone someone else's voice.

If you want to invent crypto for irl conversations, OK sure. Go ahead. But the core of this issue is that people are getting spammed by robot dialers because digital identity in the context of a phone number is a figment of the FBI's imagination. Completely opaque to laypeople.

It has nothing to do with phone numbers. If your child or spouse or parent called you in distress from a random phone number, there are countless believable reasons they could offer for it being from a random phone number, and no you're almost certainly not going to say "ya sorry not talking to you [child/spouse/parent] unless you call me back from the phone number you claim to have lost/broke/had seized."

This scam doesn’t require that the victim received a call from a known phone. It could come from any random phone number or other audio channel. That might be one factor making the victim suspicious but they are going to be primarily influenced by the voice and will be highly motivated to comply while ignoring “minor” inconsistencies. How would cryptography help a grandmother getting a call from her “grandson” who needs help?

A culture that understands and values digital identity rooted in cryptographic security won't be so quick to panic. It is an education and culture problem more than technical.

Not really. There are millions of perfectly believable scenarios in which a loved one wouldn't have access to whatever cryptographic key you're imagining, but needs your assistance nonetheless.

Not sure how your second statement follows the first... Agreed this isn't a technical problem per se.

Okay I think I understand you now.

And on some level I agree, but I also think you're failing to consider how much people vary in their abilities and personalities.

Your criticism of the institutions meant to protect our security seems reasonable though.

I've really tried to understand your judgement but I'm not able to yet. You're bringing up sms, but what does that have to do with voice cloning?

Read all your comments in this thread, and you're still not making sense to me.

I'm guessing but the problem is source phone number spoofing. If Caller ID worked correctly 100% of the time and 100% of the time you get a fraud/spam/etc call you could complain and the authorities knew who owned the phone number it would be harder to operate the fraud. And with personal cryptographic attestation you could reliably link a phone number to a person.

This was literally one of McGruff the Crime Dog's safety tips back in the day: have a secret family password so if a stranger rolls up and tells you your dad's in the hospital, you can verify that your dad did in fact send him.

Or you can use the phone in your pocket to call your dad and anyone who might know about his status.

In the 80s, when these ads ran, no one had a phone in their pocket.

So... The FBI is giving security advice that is 45 years out of context?

The FBI is reviving a good, basic opsec practice from the 80s for a more modern purpose.

"ChatGPT, please analyze every social media profile of the target and their family and produce an expected password."

More like “Dad I’m calling you from prison and I don’t trust that I’m actually talking to you and not a deepfake so can you tell me that password we talked about?” Then dad gives not you the password. There are infinite ways to socially engineer people.

So you have an "older" and "younger" password. If you are the younger person (ie child) in the conversation you tell them the "younger" password, and if you are the older you tell them the "older" password.

or something like that. Remember this is mostly to defeat casual one-off scams.

Reply on news.ycombinator.com