When creating new skills/apps for a voice assistant such as Google Home or Amazon Echo, are there any established patterns for providing an extra level of security for certain actions that go beyond just a PIN or password?
Here's an example: let's say your skill/app allows you to call a cab. So you'd say something like "Alexa, call me a cab". Now, if there's no additional security at all, anyone in proximity of your voice assistant could call a cab in your name - not ideal.
A fixed PIN or password can provide some level of security: "Alexa, call me a cab!" - "Sure thing, what's the PIN?" - "It's 1234!"
Unfortunately, if you do this frequently, someone will eventually overhear your PIN or password. Could be your malicious neighbor, or simply your mischievous kids. So that's still vulnerable.
What I would imagine to be more secure would be some sort of Challenge–response authentication protocol that's easy enough for humans to implement in their head - something like: "Alexa, call me a cab!" - "Ok, security check: my challenge is 72, what is your response?" - "It's 10."
The tricky part here is that computing the response would have to be very easy- most humans, of course, won't be able to compute a cryptographic hash function in their head. But something straightforward such as "add 7 to the challenge" would probably be good enough to prevent your toddler from calling a cab on your behalf. Once they're in elementary school, you'd have to switch to something a little bit more sophisticated like "add hour of the day and day of the month".
Are there any established pattern for this?