4 ms·

> The traffic from the Echo has been studied extensively. Detection of the wake word is hardware-based For now, maybe. If some update changed this, how and whe

by a3_nm 11y ago

> The traffic from the Echo has been studied extensively. Detection of the wake word is hardware-based For now, maybe. If some update changed this, how and when would you figure out? I'd say it's not entirely silly to be worried about something in your home which is controlled by a third party and could turn into a spying device at any moment, even though it seems not to have become evil yet.

cthalupa 11y ago
>If some update changed this, how and when would you figure out The echo traffic always flows through your internet - it has no 3G/4G hardware, for example. If you want to do a pcap with tcpdump or similar, you can. When I first received mine, I set up a packet capture on my linux firewall/ips/nat device and looked at traffic outbound to the internet from the echo. If I was particularly paranoid, I could leave this running 24/7 outputting to a pcap, and then watch that file for changes and get notifications whenever it did. Honestly, if you're worried about this sort of thing, you shouldn't own a cell phone.
- goldenkey 11y ago
  "Honestly if you are worried about this sort of X, you shouldn't live in a [subset of first-world country utilities.]" Ad hominem. C'mon, I expect better specious arguments on Hacker News.
  - cthalupa 11y ago
    That's not even remotely an ad hominem, though I imagine you just mean it's a fallacious argument in general. That being said, hardly. We already know that law enforcement can use cell phones to spy on people. There is an abstract fear that the Echo might do this in the future (enough analysis has been done to know that it does not currently), yet we know for sure that cell phones can do it currently. https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Cellphone_surveillance https://en.wikipedia.org/wiki/Cellphone_surveillance http://www.cnet.com/news/fbi-taps-cell-phone-mic-as-eavesdropping-tool/ http://www.cnet.com/news/fbi-taps-cell-phone-mic-as-eavesdro... http://www.foxnews.com/tech/2013/08/02/fbi-can-remotely-activate-microphones-in-android-smartphones-source-says.html http://www.foxnews.com/tech/2013/08/02/fbi-can-remotely-acti...
    - goldenkey 11y ago
      It is ad hominem because you implicate anyone who worries about one device to stop worrying because you can choose from a bouquet, some other flower they should be more worried about. Gun safety says it's unwise to point a gun, even an unloaded or uncocked gun, at someone you don't wish to shoot. In the same vein, it's unsettling to have microphones and cameras around one's house _even_ if you suppose they are off. Because the latent ability is potential oppression.
      - cthalupa 11y ago
        Ad hominem is quite explicitly attacking the person who made the argument, and not the argument itself. I believe the fallacy you're looking for is 'fallacy of relative privation', but even then, we're still not there. Fundamentally, the issue is this: The fear is that the microphone could be used as a listening device. From the current factual information we have available, we know, at this time, that: 1) Law enforcement agencies can and do use cell phones as listening devices, both in intercepting calls and remotely enabling the microphone. 2) It is not possible to see all traffic that is flowing through your cell phone in many cases (iPhones, non-rooted Android phones, etc) 3) It is possible to see all traffic that is flowing through your home network. If it is encrypted you might not be able to determine the specific contents, but you still have the technical possibility to see when communication occurs 4) We do not currently see any evidence that the Echo performs any sort of recording or transmission of voice data outside of when the 'wake word' is used. You'll notice nowhere did I say these fears were completely unfounded - just that there is no evidence to suggest this is occurring, and that if it were occurring, we would not be without ability to detect it. But by the same token, these selfsame fears, that an electronic device can be used to listen in on you, are 100% confirmed to be true with cellphones. We know that they can be used to listen in on you. Therefore, if your concerns are your electronics being used as a surveillance device, then cellphones are a clear and present risk and should not be owned. And if we're throwing around fallacy accusations, and your argument is "We shouldn't have remotely accessible microphones and cameras around, because they'll be used as surveillance devices", then you're participating with a classic slippery slope fallacy - but I don't think all of the fallacy talk is particularly productive, either.
  - notlisted 11y ago
    Feel free to replace the word 'you' with 'one', so read "If one were truly worried about spy devices, one should really consider dropping their cell phone in the toilet." Other commenters have provided enough detail on what is currently a fact with cell phones microphones. Ignoring voice, your location (via GPS and/or cell tower), browsing and calling history, etc. etc. is recorded and transmitted to third parties constantly and not just google either, see http://www.bbc.com/news/technology-34732514 http://www.bbc.com/news/technology-34732514
- a3_nm 11y ago
  > traffic outbound to the internet from the echo A paranoid fear would be that the Echo could be recording additional traffic (based on special stealthy trigger words maybe) and sending that traffic later, in conjunction with regular traffic recorded for the regular trigger word, so as to escape detection. It does sound a bit harder to pull off, I just wanted to point out that spying on the traffic won't get you perfect security if (as I expect) the traffic is encrypted. > Honestly, if you're worried about this sort of thing, you shouldn't own a cell phone. Fair point, but as further comments pointed out, taking one kind of risk doesn't mean you're OK with taking more of the same kind of risk. :) I already take fair precautions against my cell phone, but I have to concede that, with radio firmwares being proprietary, it seems true that any cell phone nowadays is as risky as the echo.
- tripzilch 11y ago
  > If you are truly worried about spy devices, you should really consider dropping your cell phone in the toilet. > Honestly, if you're worried about this sort of thing, you shouldn't own a cell phone. People keep saying this but not owning a cell phone doesn't help against being in the vicinity of a far-field microphone connected to echo? Then your idea about pcapping 24/7, I'm not sure what this data would look like, but given that the software emitting it is closed-source and auto-updating, wouldn't it change every other update or so? You'd have to re-reverse the data every time to see what it's actually sending, sounds like a lot of work, like keeping an eye on a young child to make sure it's not creating/getting into any trouble. You can call it "paranoid", but I think by now we have all seen enough reports about these sorts of things going wrong (on purpose or by accident), it's more reasonable to say that you are okay trading convenience for privacy+security than calling the people who aren't, "paranoid". It's 2016. BTW if you can make sense of the pcapped data sent out, that means it's not encrypted, right?

by a3_nm 11y ago

cthalupa 11y ago

>If some update changed this, how and when would you figure out The echo traffic always flows through your internet - it has no 3G/4G hardware, for example. If you want to do a pcap with tcpdump or similar, you can. When I first received mine, I set up a packet capture on my linux firewall/ips/nat device and looked at traffic outbound to the internet from the echo. If I was particularly paranoid, I could leave this running 24/7 outputting to a pcap, and then watch that file for changes and get notifications whenever it did. Honestly, if you're worried about this sort of thing, you shouldn't own a cell phone.

goldenkey 11y ago
"Honestly if you are worried about this sort of X, you shouldn't live in a [subset of first-world country utilities.]" Ad hominem. C'mon, I expect better specious arguments on Hacker News.
- cthalupa 11y ago
  That's not even remotely an ad hominem, though I imagine you just mean it's a fallacious argument in general. That being said, hardly. We already know that law enforcement can use cell phones to spy on people. There is an abstract fear that the Echo might do this in the future (enough analysis has been done to know that it does not currently), yet we know for sure that cell phones can do it currently. https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Cellphone_surveillance https://en.wikipedia.org/wiki/Cellphone_surveillance http://www.cnet.com/news/fbi-taps-cell-phone-mic-as-eavesdropping-tool/ http://www.cnet.com/news/fbi-taps-cell-phone-mic-as-eavesdro... http://www.foxnews.com/tech/2013/08/02/fbi-can-remotely-activate-microphones-in-android-smartphones-source-says.html http://www.foxnews.com/tech/2013/08/02/fbi-can-remotely-acti...
  - goldenkey 11y ago
    It is ad hominem because you implicate anyone who worries about one device to stop worrying because you can choose from a bouquet, some other flower they should be more worried about. Gun safety says it's unwise to point a gun, even an unloaded or uncocked gun, at someone you don't wish to shoot. In the same vein, it's unsettling to have microphones and cameras around one's house _even_ if you suppose they are off. Because the latent ability is potential oppression.
    - cthalupa 11y ago
      Ad hominem is quite explicitly attacking the person who made the argument, and not the argument itself. I believe the fallacy you're looking for is 'fallacy of relative privation', but even then, we're still not there. Fundamentally, the issue is this: The fear is that the microphone could be used as a listening device. From the current factual information we have available, we know, at this time, that: 1) Law enforcement agencies can and do use cell phones as listening devices, both in intercepting calls and remotely enabling the microphone. 2) It is not possible to see all traffic that is flowing through your cell phone in many cases (iPhones, non-rooted Android phones, etc) 3) It is possible to see all traffic that is flowing through your home network. If it is encrypted you might not be able to determine the specific contents, but you still have the technical possibility to see when communication occurs 4) We do not currently see any evidence that the Echo performs any sort of recording or transmission of voice data outside of when the 'wake word' is used. You'll notice nowhere did I say these fears were completely unfounded - just that there is no evidence to suggest this is occurring, and that if it were occurring, we would not be without ability to detect it. But by the same token, these selfsame fears, that an electronic device can be used to listen in on you, are 100% confirmed to be true with cellphones. We know that they can be used to listen in on you. Therefore, if your concerns are your electronics being used as a surveillance device, then cellphones are a clear and present risk and should not be owned. And if we're throwing around fallacy accusations, and your argument is "We shouldn't have remotely accessible microphones and cameras around, because they'll be used as surveillance devices", then you're participating with a classic slippery slope fallacy - but I don't think all of the fallacy talk is particularly productive, either.
- notlisted 11y ago
  Feel free to replace the word 'you' with 'one', so read "If one were truly worried about spy devices, one should really consider dropping their cell phone in the toilet." Other commenters have provided enough detail on what is currently a fact with cell phones microphones. Ignoring voice, your location (via GPS and/or cell tower), browsing and calling history, etc. etc. is recorded and transmitted to third parties constantly and not just google either, see http://www.bbc.com/news/technology-34732514 http://www.bbc.com/news/technology-34732514
a3_nm 11y ago
> traffic outbound to the internet from the echo A paranoid fear would be that the Echo could be recording additional traffic (based on special stealthy trigger words maybe) and sending that traffic later, in conjunction with regular traffic recorded for the regular trigger word, so as to escape detection. It does sound a bit harder to pull off, I just wanted to point out that spying on the traffic won't get you perfect security if (as I expect) the traffic is encrypted. > Honestly, if you're worried about this sort of thing, you shouldn't own a cell phone. Fair point, but as further comments pointed out, taking one kind of risk doesn't mean you're OK with taking more of the same kind of risk. :) I already take fair precautions against my cell phone, but I have to concede that, with radio firmwares being proprietary, it seems true that any cell phone nowadays is as risky as the echo.
tripzilch 11y ago
> If you are truly worried about spy devices, you should really consider dropping your cell phone in the toilet. > Honestly, if you're worried about this sort of thing, you shouldn't own a cell phone. People keep saying this but not owning a cell phone doesn't help against being in the vicinity of a far-field microphone connected to echo? Then your idea about pcapping 24/7, I'm not sure what this data would look like, but given that the software emitting it is closed-source and auto-updating, wouldn't it change every other update or so? You'd have to re-reverse the data every time to see what it's actually sending, sounds like a lot of work, like keeping an eye on a young child to make sure it's not creating/getting into any trouble. You can call it "paranoid", but I think by now we have all seen enough reports about these sorts of things going wrong (on purpose or by accident), it's more reasonable to say that you are okay trading convenience for privacy+security than calling the people who aren't, "paranoid". It's 2016. BTW if you can make sense of the pcapped data sent out, that means it's not encrypted, right?