Ask security questions

Vitalik Buterin argues that audio or video of a person can no longer serve as a secure way to authenticate identity, and that security questions based on shared personal experiences are a practical answer. He cites a company that lost $25 million after a finance worker was convinced by a deepfaked video call to send a bank wire to a scammer posing as the CFO, and notes that deepfakes of him have been used in scams and a dog coin promotion. He argues that cryptographic signatures alone fail in multisig approvals, since verifying a signer's key lets an attacker with that key pass as the owner. The article recommends stacking security questions with code words, delays and multi-channel confirmation.