Voice recognition and security

Msradell DeleteThis @aol.com wrote:
> I am presently handicapped to the degree that I can't use a keyboard or
> mouse so Windows Vista voice recognition of the godsend. It works
> really well in most circumstances however whenever it security alert
> occurs it appears to override voice recognition so I can that
> acknowledge or cancel. In order to avoid this problem I've been forced
> to turn off user account security. With this turned off the computer
> runs OK but I'm not utilizing many security features. Is there a way
> that I can get voice recognition to work in answering the security
> alerts? Click send

I don't think so

There's a security issue. An attacking application could turn on voice
recognition, play a sound file which 'says' the word "continue" and then
ask for elevated permission.

Voice recognition (foolishly) doesn't cancel out feedback from the speakers.

Alun Harford

> > I am presently handicapped to the degree that I can't use a keyboard or
> > mouse so Windows Vista voice recognition of the godsend. It works
> > really well in most circumstances however whenever it security alert
> > occurs it appears to override voice recognition so I can that
> > acknowledge or cancel. In order to avoid this problem I've been forced
> > to turn off user account security. With this turned off the computer
> > runs OK but I'm not utilizing many security features. Is there a way
> > that I can get voice recognition to work in answering the security
> > alerts? Click send
>
> I don't think so

Sure you can!
http://windowshelp.microsoft.com/Windows/en-US/Help/dca6513b-b68c-400c...86-dcfa

You need to disable the switch to the secure desktop. The built-in speech
recognition feature in Windows Vista does not operate on the secure desktop.
If you disable the secure desktop part of UAC you will be able to use speech
recognition to answer the elevation prompt. Keep in mind that this does lower
the security of your system to some extent, but my guess is that if you rely
on this feature that's a trade-off you are willing to take.

You did not mention which version of Vista you are using, but if you are
using anything other than Business, Enterprise or Ultimate the directions in
the web link I gave you will not work. In that case, run this command from an
elevated command prompt instead:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v
PromptOnSecureDesktop /t REG_DWORD /d 0 /f


To elevate a command prompt do this:
1. Click the Window button
2. Click All Programs
3. Click Accessories
4. Right-click Command Prompt and select Run as administrator
5. Accept the UAC prompt.

I won't comment on the obvious chicken and egg scenario involved in having
to dismiss a UAC prompt to configure your system so you can dismiss the UAC
prompts. Hopefully you can find someone to help you with that.

> There's a security issue. An attacking application could turn on voice
> recognition, play a sound file which 'says' the word "continue" and then
> ask for elevated permission.

Not really. An attacker can't turn on voice recognition. The attack only
works if the feature is already on. Then the attacker needs to play an audio
file with commands that work in the context of what the computer is asking
for. That is pretty hard to pull off to do anything really interesting.
Mostly it is an annonyance.


---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/0470101555?ie=UTF8&tag=protectyourwi-20