3 ms·

It doesn't record everything said in your house. It only listens to the wake word, and then records. Source: I worked on some of the low level audio functionali

by eclipxe 10y ago

It doesn't record everything said in your house. It only listens to the wake word, and then records. Source: I worked on some of the low level audio functionality.

Eridrus 10y ago
These comments about the NSA listening to you through these get annoying enough to me, I hate to think how annoying they must be to you when you built the damn thing.
- CaptSpify 10y ago
  Is there any reason an Echo couldn't be updated to add 24/7 listening? Just because someone built a part of it doesn't mean they know how it works now
  - tekromancr 10y ago
    It would be pretty trivial to detect the network transit of the thing sending audio 24/7.
    - CaptSpify 10y ago
      Sure, if you were watching. But most people don't watch their network 24/7. Even if you watched it for one week, the next week they could turn it on 24/7, then turn it back of a couple of days later. It's only trivial to detect if everyone is watching all the time.
  - Eridrus 10y ago
    They could do the same thing to your computer or phone or even any speaker you have; why are we freaking out about this except for the fact that it's being sold as a microphone? Why don't we freak out that Chrome could be listening to all our audio? I guess you could make an argument that far-field mics make it different, but I have a lot of conversations near my laptop and phone. As tekromancr mentioned; it would be pretty obvious if these changes were made, especially on a wide-ranging basis, so that only really leaves this potential capability being used in a targeted manner, at which point Mossad is after you specifically and you're gonna get Mosadded. (https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf) Having said that, I would be interested in a 3rd party maintained registry of updates for all software so that it would at the very least be noticeable if updates were being abused for this purpose, similar to the way certificate transparency works for SSL/TLS certs.
    - CaptSpify 10y ago
      > They could do the same thing to your computer or phone or even any speaker you have... Absolutely. That's why I don't really let stuff auto-update, use as much FOSS stuff as I can, etc. Just because someone can push a malicious update to $product_a doesn't mean we should ignore the fact that they can do it to $product_b. I fail to see the logic here. > Why don't we freak out that Chrome could be listening to all our audio? I do. And that's why I don't use Chrome. Just because you don't seem to be worried doesn't mean other people don't worry about it. > ...it would be pretty obvious if these changes were made, especially on a wide-ranging basis... Maybe, but I'm not worried just about wide-ranging basis, but a narrow-ranging basis as well.
      - Eridrus 10y ago
        > I fail to see the logic here. Most people are not concerned about Chrome, iOS or Android auto-updating; I'm sure you can see that you're an outlier here. FOSS software might not have automatic updates, but if you do any sort of update where you don't verify the blob you got is the same one as everyone else you have exactly the same problem. I largely expect that unless you get super paranoid about this (and hey, we're on HN, so that's a possibility), you're not really going to stop a sophisticated government adversary. And at the point where you're on a specifically targeted list, they will probably not limit themselves to the digital world. I also think that expecting this level of privacy where the government cannot figure out what you're doing is a historical anomaly; most people who avoided telephones because the government could be listening are generally considered crazy people. Does the government target people in a violation of their civil rights? Yes, but you probably know if you're doing something the government doesn't like, and it does not seem sensible to argue that people should become experts in technology and then give up a lot of benefits to avoid a risk that is not real for them.
        CaptSpify 10y ago
        > Most people are not concerned about Chrome, iOS or Android auto-updating; I'm sure you can see that you're an outlier here. Sure, but I don't see how that invalidates my point. Some people are concerned about privacy, some people aren't. That doesn't mean the original software couldn't be updated with malicious code. > FOSS software might not have automatic updates, but if you do any sort of update where you don't verify the blob you got is the same one as everyone else you have exactly the same problem. I'd disagree. Having the ability to verify it has kept a lot of people from pushing a lot of bad code because they know they could be caught. > you're not really going to stop a sophisticated government adversary. I'd agree, but just because I can't really stop someone from breaking into my house doesn't mean I'm OK with putting a key under my doormatt. > I also think that expecting this level of privacy where the government cannot figure out what you're doing is a historical anomaly There's a huge difference between being able to figure out, and recording everything for later use. > most people who avoided telephones because the government could be listening are generally considered crazy people. lolno. Movies have often had a trope about talking in person because "someone could be listening" for a long time. Audiences understand this quite well and go along with the story. And it doesn't have to be the government. When party-lines were common, people knew you had to be careful, or the town gossip could get all the juicy details. The Public has long known that someone could be listening. The difference now is that a lot of actors are trying to always be listening. > it does not seem sensible to argue that people should become experts in technology and then give up a lot of benefits to avoid a risk that is not real for them. I'm not really sure where I said that. If I did, I'd like you to point it out. I just think people should be able to educate themselves and decide for themselves if that trade-off is worth it. I'm not saying people shouldn't make the tradeoff, but pretending that "It's OK, the Echo could never be used maliciously because some guy on HN said he wrote the software and it doesn't do that" is naive at best.

by eclipxe 10y ago

It doesn't record everything said in your house. It only listens to the wake word, and then records. Source: I worked on some of the low level audio functionality.

Eridrus 10y ago

These comments about the NSA listening to you through these get annoying enough to me, I hate to think how annoying they must be to you when you built the damn thing.

CaptSpify 10y ago
Is there any reason an Echo couldn't be updated to add 24/7 listening? Just because someone built a part of it doesn't mean they know how it works now
- tekromancr 10y ago
  It would be pretty trivial to detect the network transit of the thing sending audio 24/7.
  - CaptSpify 10y ago
    Sure, if you were watching. But most people don't watch their network 24/7. Even if you watched it for one week, the next week they could turn it on 24/7, then turn it back of a couple of days later. It's only trivial to detect if everyone is watching all the time.
- Eridrus 10y ago
  They could do the same thing to your computer or phone or even any speaker you have; why are we freaking out about this except for the fact that it's being sold as a microphone? Why don't we freak out that Chrome could be listening to all our audio? I guess you could make an argument that far-field mics make it different, but I have a lot of conversations near my laptop and phone. As tekromancr mentioned; it would be pretty obvious if these changes were made, especially on a wide-ranging basis, so that only really leaves this potential capability being used in a targeted manner, at which point Mossad is after you specifically and you're gonna get Mosadded. (https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf) Having said that, I would be interested in a 3rd party maintained registry of updates for all software so that it would at the very least be noticeable if updates were being abused for this purpose, similar to the way certificate transparency works for SSL/TLS certs.
  - CaptSpify 10y ago
    > They could do the same thing to your computer or phone or even any speaker you have... Absolutely. That's why I don't really let stuff auto-update, use as much FOSS stuff as I can, etc. Just because someone can push a malicious update to $product_a doesn't mean we should ignore the fact that they can do it to $product_b. I fail to see the logic here. > Why don't we freak out that Chrome could be listening to all our audio? I do. And that's why I don't use Chrome. Just because you don't seem to be worried doesn't mean other people don't worry about it. > ...it would be pretty obvious if these changes were made, especially on a wide-ranging basis... Maybe, but I'm not worried just about wide-ranging basis, but a narrow-ranging basis as well.
    - Eridrus 10y ago
      > I fail to see the logic here. Most people are not concerned about Chrome, iOS or Android auto-updating; I'm sure you can see that you're an outlier here. FOSS software might not have automatic updates, but if you do any sort of update where you don't verify the blob you got is the same one as everyone else you have exactly the same problem. I largely expect that unless you get super paranoid about this (and hey, we're on HN, so that's a possibility), you're not really going to stop a sophisticated government adversary. And at the point where you're on a specifically targeted list, they will probably not limit themselves to the digital world. I also think that expecting this level of privacy where the government cannot figure out what you're doing is a historical anomaly; most people who avoided telephones because the government could be listening are generally considered crazy people. Does the government target people in a violation of their civil rights? Yes, but you probably know if you're doing something the government doesn't like, and it does not seem sensible to argue that people should become experts in technology and then give up a lot of benefits to avoid a risk that is not real for them.
      - CaptSpify 10y ago
        > Most people are not concerned about Chrome, iOS or Android auto-updating; I'm sure you can see that you're an outlier here. Sure, but I don't see how that invalidates my point. Some people are concerned about privacy, some people aren't. That doesn't mean the original software couldn't be updated with malicious code. > FOSS software might not have automatic updates, but if you do any sort of update where you don't verify the blob you got is the same one as everyone else you have exactly the same problem. I'd disagree. Having the ability to verify it has kept a lot of people from pushing a lot of bad code because they know they could be caught. > you're not really going to stop a sophisticated government adversary. I'd agree, but just because I can't really stop someone from breaking into my house doesn't mean I'm OK with putting a key under my doormatt. > I also think that expecting this level of privacy where the government cannot figure out what you're doing is a historical anomaly There's a huge difference between being able to figure out, and recording everything for later use. > most people who avoided telephones because the government could be listening are generally considered crazy people. lolno. Movies have often had a trope about talking in person because "someone could be listening" for a long time. Audiences understand this quite well and go along with the story. And it doesn't have to be the government. When party-lines were common, people knew you had to be careful, or the town gossip could get all the juicy details. The Public has long known that someone could be listening. The difference now is that a lot of actors are trying to always be listening. > it does not seem sensible to argue that people should become experts in technology and then give up a lot of benefits to avoid a risk that is not real for them. I'm not really sure where I said that. If I did, I'd like you to point it out. I just think people should be able to educate themselves and decide for themselves if that trade-off is worth it. I'm not saying people shouldn't make the tradeoff, but pretending that "It's OK, the Echo could never be used maliciously because some guy on HN said he wrote the software and it doesn't do that" is naive at best.