> You say a challenge sentence out loud. The device validates. ...This really isn't that hard.
Last year Lyrebird (https://lyrebird.ai/) released a demo that cloned several Presidents' voices. So while I agree with you that fingerprints are a poor choice, voice isn't better.
Well I didn't want to get bogged down in the details, but obviously I'm aware of this project and there is a ton of funding into adversarial ML and the artifacts that are generated by false voices are detectable. Even so, I appreciate the concern and it is one I share in the long run.
Regardless—possession of the device is half the battle. Authentication of the individual is the other. Even if the authentication portion is broken at worse what this means is that someone that stole your device can impersonate you. Not great, but not enough of a reason to completely disqualify voice as a mechanism.
Last year Lyrebird (https://lyrebird.ai/) released a demo that cloned several Presidents' voices. So while I agree with you that fingerprints are a poor choice, voice isn't better.