EN PT-BR
← Voltar ao feed
low

Trust Onion app uses rotating codewords and signed selfies to help verify callers against voice-scam fraud

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 02:30 · coletado há 2 horas

A Help Net Security product showcase reviews Trust Onion, a free app for macOS, iOS and Android that lets trusted groups verify who they are communicating with. It issues three codewords that rotate every minute, and adds signed selfies (Proofies), message checks, callback requests and a Scam Pulse feed of reported voice-cloning scams. The reviewer tested the iPhone app with an older person. The article frames the tool against voice-channel social engineering, citing Cisco Talos reporting on attackers posing as IT help desk staff to obtain remote access, and research on backdoored speech models.

Detalhes técnicos

  • Three codewords change every minute; a caller is asked to say the words, which are compared with the app while the user's own phrase stays private.
  • A verification form also checks phrases used by the group within the last hour; both parties must join the group beforehand.
  • Proofies are live selfies signed with a passkey unlocked by the phone's authentication method, and can be shared by link or QR code, with time and location information possibly included.
  • Anyone with a Proofie link or QR code can view it; users can add a password or delete it, which takes the link offline, but copies saved by recipients remain available.
  • The message checker flagged "hr" in a Croatian shopping promotion as a workplace reference, a keyword mismatch, and noted it cannot establish the sender's identity or the link's destination.

Remediação

  • Practice verification with trusted contacts so that pausing to check becomes habitual under pressure.
  • Review Proofie sharing settings, especially when a photo contains location information.

Linha do tempo

  1. helpnetsecurity.com ↗ · pub. 02/11/2026 02:30 · coletado 02/11 03:01 primeiro registro

    Trust Onion app uses rotating codewords and signed selfies to help verify callers against voice-scam fraud

    ler a análise desta fonte

    A Help Net Security product showcase reviews Trust Onion, a free app for macOS, iOS and Android that lets trusted groups verify who they are communicating with. It issues three codewords that rotate every minute, and adds signed selfies (Proofies), message checks, callback requests and a Scam Pulse feed of reported voice-cloning scams. The reviewer tested the iPhone app with an older person. The article frames the tool against voice-channel social engineering, citing Cisco Talos reporting on attackers posing as IT help desk staff to obtain remote access, and research on backdoored speech models.

    Technical Details

    • Three codewords change every minute; a caller is asked to say the words, which are compared with the app while the user's own phrase stays private.
    • A verification form also checks phrases used by the group within the last hour; both parties must join the group beforehand.
    • Proofies are live selfies signed with a passkey unlocked by the phone's authentication method, and can be shared by link or QR code, with time and location information possibly included.
    • Anyone with a Proofie link or QR code can view it; users can add a password or delete it, which takes the link offline, but copies saved by recipients remain available.
    • The message checker flagged "hr" in a Croatian shopping promotion as a workplace reference, a keyword mismatch, and noted it cannot establish the sender's identity or the link's destination.

    Remediation

    • Practice verification with trusted contacts so that pausing to check becomes habitual under pressure.
    • Review Proofie sharing settings, especially when a photo contains location information.