Bruce Schneier became one of my favorite writers after I read his excellent Secrets and lies: digital security in a networked world. He was and is an expert security tech guy, but his focus has changed over time to the behavioral aspects of security. The chapter called The Human Factor explains why people are the weakest link in any security system. Good stuff.
He also posts often to his security blog. Timely and interesting. I liked the 4/30 article on the biometric fingerprint reader in the gym. I guess no one wrote a "sweaty guy with barbell indents on his fingertips" use case.
Showing posts with label Biometrics. Show all posts
Showing posts with label Biometrics. Show all posts
Thursday, April 30, 2009
Sunday, January 13, 2008
Voice authentication Christmas toy
My daughter received an interesting gift for Christmas: a personal journal with voice authentication security. This little toy, called Password Journal, allows the child to record a spoken word of his or her choosing, and then access the journal with the same spoken word. If someone besides the registered owner tries to access the journal a chirpy British female voice exclaims "Intruder!" and a siren-like alarm goes off. The journal also recognizes a small number of voice commands, like setting the time of day and turning on/off an alarm.
In fact, the toy is a little hard to use for a child, and even for many adults. To get geeky-technical about it, the failure to enroll, false alarm, and false accept rates are pretty high. There aren't a lot of writing pages inside the journal, the novelty is in the voice activation itself. If you read the reviews by following the link, above, there's a lot of dissatisfaction with the product.
I helped design a voice authentication security system that is in use by a financial institution. I've also conducted research into consumers' acceptance of voice authentication. At the time the research was done (2005), people were still suspicious of VA, uncertain about its usability and effectiveness as a security solution. If people start growing up with toys that include VA, there won't be any novelty to it when they encounter VA in financial and other self service IVRs. Of course, if the toys don't perform properly then people may reject VA based on their previous experience with it. It's an interesting idea, though, that acceptance of VA as a security solution could be affected by peoples' experiences with childrens' toys.
In fact, the toy is a little hard to use for a child, and even for many adults. To get geeky-technical about it, the failure to enroll, false alarm, and false accept rates are pretty high. There aren't a lot of writing pages inside the journal, the novelty is in the voice activation itself. If you read the reviews by following the link, above, there's a lot of dissatisfaction with the product.
I helped design a voice authentication security system that is in use by a financial institution. I've also conducted research into consumers' acceptance of voice authentication. At the time the research was done (2005), people were still suspicious of VA, uncertain about its usability and effectiveness as a security solution. If people start growing up with toys that include VA, there won't be any novelty to it when they encounter VA in financial and other self service IVRs. Of course, if the toys don't perform properly then people may reject VA based on their previous experience with it. It's an interesting idea, though, that acceptance of VA as a security solution could be affected by peoples' experiences with childrens' toys.
Tuesday, July 17, 2007
More GOOG 411 - call recordings
Here's an interesting item about 800 GOOG 411: Google is recording calls for the purpose of improving its application's performance. I've blogged about GOOG 411 before; the service is a simple way to find phone numbers of businesses in any area of the country.
There's nothing unique or objectionable about recording speech samples in order to improve your application performance. Nearly anyone who uses speech IVRs probably wishes they would work better than they do. The article that I linked to quotes Google's plain language privacy policy, stating that Google is recording calls, and-for good measure-collecting ANIs in order to "personalize" the caller's experience. The article goes on to state that the recordings are used for "phonemic analysis" and "voice prints," and conjures an "Orwellian" scenario out of this information.
Whoa. Let's take a breath here. Recordings of interactions between a caller and an IVR don't necessarily mean that they're being used for "phonemic analysis." I listen to recorded calls all the time as part of tuning exercises to improve an IVR application's performance, but there's no "phonemic analysis" involved. And as far as storing voice prints, for the amount of speech that GOOG 411 requires for a search, it would be a pretty ineffective way of collecting a voice print. Not to say that it couldn't be done, but it's not the way voice prints are usually collected.
There's no doubt about one thing: people get very concerned over voice prints and other types of biometrics. I've conducted research on consumers' perceptions of voice prints and what it takes to get people to trust the technology enough to use it. There is genuine mistrust of biometric technologies that companies who employ biometrics need to deal with.
However, I can't find any reference to voice prints in any of the information provided in this article. The author read "recordings" and thought "voice prints." If that's a typical response from a customer to a "calls recorded for quality" announcement, then we all need to do some serious customer education. If Google is, in fact, collecting voice prints, I'd sure like to know how they are doing it.
There's nothing unique or objectionable about recording speech samples in order to improve your application performance. Nearly anyone who uses speech IVRs probably wishes they would work better than they do. The article that I linked to quotes Google's plain language privacy policy, stating that Google is recording calls, and-for good measure-collecting ANIs in order to "personalize" the caller's experience. The article goes on to state that the recordings are used for "phonemic analysis" and "voice prints," and conjures an "Orwellian" scenario out of this information.
Whoa. Let's take a breath here. Recordings of interactions between a caller and an IVR don't necessarily mean that they're being used for "phonemic analysis." I listen to recorded calls all the time as part of tuning exercises to improve an IVR application's performance, but there's no "phonemic analysis" involved. And as far as storing voice prints, for the amount of speech that GOOG 411 requires for a search, it would be a pretty ineffective way of collecting a voice print. Not to say that it couldn't be done, but it's not the way voice prints are usually collected.
There's no doubt about one thing: people get very concerned over voice prints and other types of biometrics. I've conducted research on consumers' perceptions of voice prints and what it takes to get people to trust the technology enough to use it. There is genuine mistrust of biometric technologies that companies who employ biometrics need to deal with.
However, I can't find any reference to voice prints in any of the information provided in this article. The author read "recordings" and thought "voice prints." If that's a typical response from a customer to a "calls recorded for quality" announcement, then we all need to do some serious customer education. If Google is, in fact, collecting voice prints, I'd sure like to know how they are doing it.
Subscribe to:
Posts (Atom)