3 ms·

It's also pretty exceptional to think that there are apps constantly listening for ultrasonic cues, even when not being actively used. This would be a huge batt

It's also pretty exceptional to think that there are apps constantly listening for ultrasonic cues, even when not being actively used. This would be a huge battery drain, so I can't imagine any manufacturer bundling such a thing with a device. Even if it was the case, I can't imagine such apps would give granular enough information to be enormously useful. You'd get one, maybe two people to actually get their computers to play the audio and have it picked up by a device that's actually listening for it. What then? How many advertising companies with legitimate marketing businesses actually sell the user identities? You'd get what, a UUID, maybe some aggregate demographic information, and a rough location. It seems unlikely that such a platform would actually give out specific PII for individuals.

treebeard901 10y ago
> It's also pretty exceptional to think that there are apps constantly listening for ultrasonic cues, even when not being actively used. It would not need to be constantly listening for it to be useful. If the point is identification, why would you leave it on after you have reasonably identified the person?
- bastawhiz 10y ago
  I mean, we're under the assumption here that the app that's listening isn't owned by the attacker. If it was, you already know the person's identity (and location, and probably a lot more) because you control the app on their device. It would be a lot of work to target and infect someone's phone with malware just so you could confirm that they did in fact visit a page on Tor. Probably the same amount of work to just infect their computer with malware and take a screenshot. If we assume it's a third-party ad network, which is the only plausible explanation for why there's an app listening for ultrasonic cues on a user's device, it would need to be listening all the time. That is what the article describes.

treebeard901 10y ago

> It's also pretty exceptional to think that there are apps constantly listening for ultrasonic cues, even when not being actively used. It would not need to be constantly listening for it to be useful. If the point is identification, why would you leave it on after you have reasonably identified the person?

bastawhiz 10y ago
I mean, we're under the assumption here that the app that's listening isn't owned by the attacker. If it was, you already know the person's identity (and location, and probably a lot more) because you control the app on their device. It would be a lot of work to target and infect someone's phone with malware just so you could confirm that they did in fact visit a page on Tor. Probably the same amount of work to just infect their computer with malware and take a screenshot. If we assume it's a third-party ad network, which is the only plausible explanation for why there's an app listening for ultrasonic cues on a user's device, it would need to be listening all the time. That is what the article describes.