Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bay Area mom out thousands after scammers use AI to mimic daughter's voice

abc7news.com

Post reply on HN
Print view View original

21–25 of 25 posts

Re: Bay Area mom out thousands after scammers use AI to mimic daughter's voice

#21

Post by DecoPerson »

windexh8er wrote: post #17
pmw wrote: post #6

TOTP can be used today to authenticate a couple to each other over an untrusted medium. It’s rather high friction; you have to set it up in advance, and then read a six digit number over the phone. And I am not sure that it mitigates the threats… in this situation, I suspect it wouldn’t. It could even make the situation worse if the daughter is genuinely in trouble but can’t access the authenticator. But I can’t thin…

A confirmation phrase and a poison pill phrase, don't overcomplicate it. This can be generated, shared and changed easily and with no tech.

My 76 old Dad loves checking the TOTP on his phone and asking me to verbally read it out when I need him to accept a 2FA push notification to let me log into his bank or government accounts so I can do something for him.

He says it “feels like 007 stuff.” “AI will never trick me!”

We also have a duress code word, listed in the notes of that KeePass(ium) entry with the TOTP.

Re: Bay Area mom out thousands after scammers use AI to mimic daughter's voice

#22

Post by duttish »

I worked on an automatic partial solution (basically caller registering phone calls, receiver verifying them) but a primary problem was that iOS doesn't allow a good enough UX for a third party dialer, even with the new dialer roles etc so I moved on.

Re: Bay Area mom out thousands after scammers use AI to mimic daughter's voice

#23

Post by valleyer »

Cider9986 wrote: post #20
valleyer wrote: post #16

Earlier quoted context omitted.

They're needed for extra revenue for KGO-TV. (Which is owned by Disney.)

That doesn't address my question but I appreciate your reply.

Sorry, maybe I should have been more explicit.

Facebook, Discord, and Twitter may sell "your data", but when they do, it's likely by selling distillations of their internal databases. (Or, of course, through vulnerabilities like the one the Cambridge Analytica Facebook app used.)

Small-ball Web sites like KGO, on the other hand, just get proposals from data aggregators to plop a snippet of HTML/JS on their site, and they get money for it. There's no control on the number of quality of them.

Big sites can't do that because they'd risk introducing serious vulnerabilities that would compromise accounts. No one has a KGO "account" to compromise. And the amount of revenue they'd provide is likely peanuts to someone like Facebook.

So: they're for revenue.

Re: Bay Area mom out thousands after scammers use AI to mimic daughter's voice

#24

Post by Cider9986 »

valleyer wrote: post #23
Cider9986 wrote: post #20

Earlier quoted context omitted.

That doesn't address my question but I appreciate your reply.

Sorry, maybe I should have been more explicit. Facebook, Discord, and Twitter may sell "your data", but when they do, it's likely by selling distillations of their internal databases. (Or, of course, through vulnerabilities like the one the Cambridge Analytica Facebook app used.) Small-ball Web sites like KGO, on the other hand, just get proposals from data aggregators to plop a snippet of HTML/JS on their site, and…

Thank you very much.

Re: Bay Area mom out thousands after scammers use AI to mimic daughter's voice

#25

Post by ProllyInfamous »

qnleigh wrote: post #19
pmw wrote: post #6

TOTP can be used today to authenticate a couple to each other over an untrusted medium. It’s rather high friction; you have to set it up in advance, and then read a six digit number over the phone. And I am not sure that it mitigates the threats… in this situation, I suspect it wouldn’t. It could even make the situation worse if the daughter is genuinely in trouble but can’t access the authenticator. But I can’t thin…

I think a verbal password works just fine here. But it has to be something that you are 100% positive the other person wouldn't forget, otherwise it's not effective. Also sending this article to family members so they're aware of this kind of thing.

My problem with this is that it's effectively one-time use, only, if you're a high-enough-value target.

Once you secret is "said" apart, over technology, it could be considered compromát.

----

Maybe have your "secret" be about a particular vacation or time period, using a novel recollection dependingupon severity of each conversation.

Post reply on HN