When creating new skills/apps for a voice assistant such as Google Home or Amazon Echo, are there any established patterns for providing an extra level of security for certain actions that go beyond just a PIN or password?

Here's an example: let's say your skill/app allows you to call a cab. So you'd say something like "Alexa, call me a cab". Now, if there's no additional security at all, anyone in proximity of your voice assistant could call a cab in your name - not ideal.

A fixed PIN or password can provide some level of security: "Alexa, call me a cab!" - "Sure thing, what's the PIN?" - "It's 1234!"

Unfortunately, if you do this frequently, someone will eventually overhear your PIN or password. Could be your malicious neighbor, or simply your mischievous kids. So that's still vulnerable.

What I would imagine to be more secure would be some sort of Challenge–response authentication protocol that's easy enough for humans to implement in their head - something like: "Alexa, call me a cab!" - "Ok, security check: my challenge is 72, what is your response?" - "It's 10."

The tricky part here is that computing the response would have to be very easy- most humans, of course, won't be able to compute a cryptographic hash function in their head. But something straightforward such as "add 7 to the challenge" would probably be good enough to prevent your toddler from calling a cab on your behalf. Once they're in elementary school, you'd have to switch to something a little bit more sophisticated like "add hour of the day and day of the month".

Are there any established pattern for this?

1 Answer 1


To begin with, You might want to think of security and lock/restraint as two different scenarios, the challenges involved in solving them are of different levels too, although the underlying principle remains the same.

Solving for restraint or accidentally issuing commands is much easier. It is as simple as taking a double confirmation like: Are you sure you want to book a cab now? - which is easier even for a child to crack. Or setup questions, the answers to which a lot of people might know with a simple browse of your Social Media Account.

Solving for security though, is a different challenge, but again has levels of complexity. However, you might notice that it all comes down to the complexity of the algorithm used in Challenge-response authentication. The level of sophistication can be increased by using many voice recognition algorithms (for Alexa or Home) as well on which a lot of study has and is being done.

  • Thanks! My understanding is that voice rec isn't quite there yet as of today. Once it is, it will entirely solve this problem, I agree.
    – Max
    Commented Dec 25, 2019 at 12:13
  • 1
    Voice Recognition Algos will be the next big thing, probably on the verge of a breakthrough/announcement from one of the big companies. But I am not sure if this will entirely solve the problem. These algos rely on the probability of voice match for authentication using sophisticated ML models, there are also ML models simulating voice and texture which will try to crack these systems. However, I recently came across an application of voice rec, customer care centre of a Big bank used my voice as a secondary authentication mechanism in addition to the credentials!
    – skott
    Commented Dec 26, 2019 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.