It wouldn't be easy for somebody to obtain a recording of my pass phrase, but it's possible.
Also, with all the phone related surveillance going on I would rather put money on the fact that my calls HAVE been recorded rather than that they HAVENT been recorded. I know you can encrypt web traffic, but right away the idea of saying something in ~~plaintext~~ plain voice over the phone seems as secure to me as tattooing my email password on my hand. I'm genuinely curious and not trying to shoot your idea down, but those are questions I would need before trusting it with anything more than a 'login of convenience'. I would use it for Skype let's say, but not my email. I might use it for Hacker News but not banking.
I had the idea of protecting client websites behind a Twilio-powered login to impress clients, but I never did it. I pictured sitting down with a client, opening a laptop to a giant lock with NO obvious text entry. You press the 'login' button and immediately your phone rings in it's pocket. "alpha forest forty five" and suddenly the lock opens and he page refreshes before their eyes. Now want to see the latest designs we have?
Sure, would love to see the designs. That is actually a very similar idea, based on two factor authentication.
>> but it's possible.
Anything is possible.. but if security is your concern, bioauthentication is much more secure than a password. Or proving you are you by.. replying to a text. Anybody could reply to a text, nobody can fake your voice, even if they know your password. Recordings don't generally work (low signal) and are much harder to attain, unless you are the NSA. In which case.. they don't need this anyway.
Security isn't the issue.. usability is. You have to enroll, and there are false negatives... and mainly it is just harder to use than typing.
(edit: that's not a rhetorical question, though I indeed don't see how it is)
Losing your phone effectively locks you out of all your 2-factor accounts. If it's stolen by the wrong people and unlocked/unencrypted, they'll get access to pretty much all of your accounts through a password reset. I'd say that's pretty bad and we have yet to find a good, secure way to authenticate users.
I'm curious, would anybody rather use that vs a typed password? It works via browser (using getUserMedia) or phone call, but the user most enroll first.