I’m pretty sure that Hey Siri is keyed to the users voice to some extent, so Siri should be safe. Not sure about Google, Cortana, Alexa etc.

"We validated DolphinAttack on major speech recognition systems, including Siri, Google Now, Samsung S Voice, Huawei HiVoice, Cortana, and Alexa."

I take that as, Siri is probably not trained to only the wake-up phrase, and as such, seems to be _not_ trained to the voice at all since this attack worked.

That, or poorly trained. Don't know, can't verify.

Emphasis on "to some extent". Relying on it is a bad idea even though it'll keep out most randos.

Speech fingerprinting, much like actual fingerprints, is not a reliable way to establish identity, especially if you want to avoid false negatives as you probably would in mass consumer facing technology.

Siri recognises the "hey siri" bit unique to the owner, further commands aren't validated.

"OK Google" on my Pixel is keyed to my voice and can be used to unlock the phone (though I turned that feature off), but I'm not sure if it validates my voice when the phone is already unlocked, or if other google devices like the Home allow this.

You are correct that Apple claims that the opening "Hey, Siri" is trying to match against your voice specifically: https://techcrunch.com/2015/09/11/apple-addresses-privacy-qu...

No. It absolutely is not. There is no way (currently) to train Siri to just your voice.

Cortana has that as an option in Settings, but it's not on by default.

Siri is not keyed to anything . My daughter can talk to her as i do.

"Hey Siri" is.

Not on my phone, my whole family can trigger it.

While it's locked?

Yes.

How about forwarding password reset emails?

"Siri, forward my Ashley Madison password email to my wife"