11 ms·

Amazon may give developers your private Alexa transcripts

77 points by okket 9y ago

petejodo 9y ago
the other day I thought of a secondary device (that's not connected to the internet) that would go along with Alexa or whatever mic-connected device that "somehow" scrambles the sounds so that it's just noise to Alexa until you say the keyword, at which point it unscrambles for some given period of time so Alexa can understand. Is such a device possible?? I don't know, probably not but it would help me feel better about getting one of these devices
chinathrow 9y ago
> It would also raise serious privacy concerns for users. To me, that device class alone raises serious privacy issues.
- ocdtrekkie 9y ago
  Yeah, I mean, I wanna raise a privacy outrage over this news but like... If you put an Amazon or Google connected microphone in your house... You've already given up your privacy. Who else they share it with is just gravy at that point.
  - Retric 9y ago
    I actually want a device like this that does not connect to the internet. So, I can ask for the time while half asleep without opening my eyes and more importantly while keeping my bedroom dark. However the idea of having an always on microphone connected to the internet creeps me out.
    - ocdtrekkie 9y ago
      There's a few open source projects out there. I wouldn't recommend anyone use mine, because its written for my needs. And one of the important parts... Speech recognition... Isn't implemented yet. ;) But I think there's a huge perk to a 'personal' digital assistant... One built for your needs, not a corporation's.
    - ashark 9y ago
      > I actually want a device like this that does not connect to the internet. You won't get a decent one until we outlaw spying on people in exchange for a service. Then plenty will pop up. There's just no point in trying to compete with these services now, and anyone who tried and did even a sort-of OK job would just get snapped up by (or, failing that, mercilessly destroyed by) a bigco and set to working on spying services. FWIW I also think "loyalty card" and CC data collection/selling should be illegal, not just spyvertising Internet services. The standard should be only allowing the bare minimum to make the service work (so CCs would have to collect transaction data, yes), NO selling or sharing, transparency requirements, retention limits, and prohibitions on vertical integrations that allow companies to use what they know against people when trying to sell unrelated goods/services.
  - mikeash 9y ago
    Everybody with a cell phone already does this. Why does it seem like this worry is confined to things like the Echo?
    - ocdtrekkie 9y ago
      The biggest difference is cell phones aren't listening for activation words to then transmit audio to the cloud. The chance of accidental activation and transmission is much lower. Yes, there are phones that offer this as a feature, but you'd better believe I won't use those either.
      - mikeash 9y ago
        Cell phones aren't doing this... that you know of. If you don't trust Amazon or Google (and I don't mean to imply that you should!) then it seems like you can't trust them not to lie about when the mic is on.
      - reaperducer 9y ago
        "Hey, Siri" and "OK, Google" disagree.
digitalzombie 9y ago
I mean Amazon erased 1984 from kindle users so yeaaah. This is one more data point in the they don't care about you category.
redm 9y ago
I can't say I'm surprised. Removal of privacy is an ongoing process as we, as users, continue to trade privacy for convenience. After each milestone, we settle in to allow for the next. I don't see this changing, at the end of the day, people value convenience over privacy, even if we yell about it.
- deleted 9y ago
  [deleted]
- ertemplin 9y ago
  This isn't removal of privacy. The article even says that the information would be limited to transcripts of interactions for skills that the developer owns. Currently developers can only see what users are trying to do if they successfully invoke a registered "intent". For example: GetHoroscope what is the horoscope for {Sign}. The only information that the developer can currently see is that the user invoked the "What is the horoscope for" intent and provided the "Sign" parameter. This would allow developers to handle all interactions with their skill, not just registered intents.
draw_down 9y ago
Seems like you should go ahead and assume this is happening if you use one.
EduardoBautista 9y ago
Every time I read something like this, I further justify my decision to buy into the Apple ecosystem. They may be proprietary, but they haven't done anything privacy-wise to upset me.
- jstanley 9y ago
  Every time I read something like this, I further justify my decision not to buy into anybody's ecosystem! Free software and decentralisation is the answer.
  - gregjw 9y ago
    Calm down, Stallman.
    - AlexandrB 9y ago
      Stallman is an optimist.
    - jasonkostempski 9y ago
      Rage up, Smith.
  - EduardoBautista 9y ago
    If you can give me a reasonable alternative for a smartphone that respects your privacy and doesn't make me live like I did a decade ago, I will switch.
    - jstanley 9y ago
      I run CopperheadOS: https://copperhead.co/android/ https://copperhead.co/android/ It's Android, but without non-free software, and without any reporting to Google.
  - the_common_man 9y ago
    I agree that decentralisation is the answer but that software does not need to be 'Free'. It's great if it is but there are hardly any companies that make purely 'Free' (as in freedom) products and make money.
whazor 9y ago
I thought this already happens, as long as your voice app is being called. You have special analytics tooling.
mikeash 9y ago
The headline is missing the part where it's the transcripts of your interactions with that developer's service. They're not handing over your full transcripts of all interaction with the device. Rather misleading. My only reaction to this is that it's kind of weird they weren't already doing it.
- throwaway2016a 9y ago
  Exactly this. Being able to see what users are actually saying to your chat bot is critical to do development. Without it, it is like trying to debug an issue with a website without being able to see the HTTP access logs. Furthermore, the bot already knows when you say the right things to it, because what command you issued is sent to the developer's lambda endpoint so they can fulfill your request. This is just telling the developer when you say things to their app that weren't properly recognized by the AI. Previously it was like telling a developer: you got this many 404 errors but we won't tell you what page they were on. This is just telling the developer what page.
  - snarf21 9y ago
    Yeah, and this is the information that is needed to really move these skills forward. I wish you could set a threshold on the intents based on confidence level and prioritization to have more of a custom fall through logic.
  - ceejayoz 9y ago
    I understand entirely the need... but at some point some developer's going to get a transcript that goes "Alexa, order me an Uber." "To where?" "OH NO YOU DON'T ASSHOLE YOU HAD SEX WITH MY COUSIN AND WE'RE GOING TO TALK ABOUT THIS RIGHT NOW".
    - throwaway2016a 9y ago
      While I think that is possible the same is true if I'm on the phone with the dispatcher at a Taxi company and no one is saying the phone company is disrespecting my privacy for sending the full uncensored audio of what I say into the phone to the phone number I called. I actually like that analogy better than the website one I gave... effectively when you activate a bot of any kind you are calling that bot.
__jal 9y ago
Doesn't change anything for me, other than affirm my decision to not bug my own home. These seem like fun toys, but there's no way I'm allowing closed-source surveillance devices that send data to who-knows-where/who, under terms that are mutable by a TOS change nobody ever sees, protected by a firm with interests only sometimes aligned with mine, stored for who knows how long in to my home. Even if you're fine with all the rest and think Amazon/Google/Apple/whoever is perfectly aligned with your interests, the storage aspect should be troubling. In the US, we've been on a steady downward slope of privacy intrusions from our government. Imagine your personal political boogyman in power when the next bad terrorist strike happens and everyone is in freak-out mode. Last time the Patriot act was sitting in a drawer, waiting for the right time. What is in the next version, sitting in a drawer right now?
- wukerplank 9y ago
  Whenever I saw a dystopian movie/comic where people would willingly put an always on listening device into their homes, I thought: "Never gonna happen!"
  - Joe-Z 9y ago
    Because in dystopian movies (your comment reminded me of 'The Fifth Element') they never show the 'but it's just so convenient!'-part. Not arguing for these things, I'd never get one either, but I'm just saying there are (probably?) positive sides to having one as well.
- rblatz 9y ago
  Odds are you carry one with you everywhere you go.
- hbosch 9y ago
  Better be quiet, your laptop, TV, cell phone and car are listening...
slg 9y ago
I have a question for anyone who has privacy concerns with these type of devices: do you own a smartphone? Those seem nearly infinitely more dangerous from a privacy standpoint than a smart speaker. First off, you are likely to carry them with you wherever you go instead of being stationary in your home. Secondly they are more technically advanced with additional sensors like GPS and much higher processing power and storage space. And lastly they are much more difficult to completely monitor due to having a network connection that isn't created and operated by the device's owner.
- ceejayoz 9y ago
  My smartphone is plenty useful even if Siri is turned off, though.
- ahelwer 9y ago
  Yes, our lives are already privacy dumpster fires. Doesn't mean we should wish the fire to grow.
- AlexandrB 9y ago
  I think it's the level of intimacy implied by an always-on listening device in your home. While a cellphone can track your location, I think people have adapted to the idea of being tracked in public. What's creepy about smart speakers is that there's now something in your home that can betray the simple privacy of a conversation with a friend. This is something new.
  - slg 9y ago
    If you are willing to believe that a smart speaker is compromised to a degree that violates your privacy, why would you believe your cell phone can't be compromised to the same degree? You cell phone is also likely to be present for every "conversation with a friend" at which your smart speaker is present so I think the "intimacy" issue is a red herring.
    - AlexandrB 9y ago
      > If you are willing to believe that a smart speaker is compromised to a degree that violates your privacy IMHO the smart speaker's normal function violates my privacy by recording what I'm saying and sending it to Google/Amazon/Whomever for unspecified data analysis and processing. It doesn't need to be compromised to do so. > You cell phone is also likely to be present for every "conversation with a friend" at which your smart speaker is present so I think the "intimacy" issue is a red herring. You're right, but the perception of privacy is not rational. A modern smartphone's primary interface is not its microphone - at least not yet. A smart speaker's primary interface is its always-on microphone. This is not too dissimilar from how Google Glass was creepy because one of its main features is as a potentially-always-on camera - even though a smartphone also has a camera.
throwaway2016a 9y ago
This comment thread, the thread on the article, and the article itself are so disappointing. I expected more from Hacker News and Engadget. This is fake news and so many people fell for it. And I NEVER use the term fake news, this is literally the first time. Like many cases of fake news it is based on something that is true but either through ignorance or intentional misdirection is drawing and leading people to draw a false conclusion. What is actually happening: - Website app can see an access log of every page you visit on it when previously they could only see successful pages that didn't error or result in a 404. Just instead of a typed URL it is a spoken sentence. - Web app STILL CANNOT access what you requested from other web apps (other Alexa skills). What everyone is ready and the Engadget article strongly implies: - amazon is now sending everything you say to all developers even if you said to to another app Edit: To the one person (so far) who down-voted me and to the others who probably will as well... I'm OK with that. I am willing to sacrifice some HN karma to spread the word that intentionally misleading articles like this are not OK. And coming on Hacker News and allowing yourself to be mislead rather than form your own opinion is also not OK. We deserve better.
- AlexandrB 9y ago
  > Just instead of a typed URL it is a spoken sentence. This is why I'll never use a smart speaker - the line between when I am and am not subject to Amazon's privacy policy and information sharing with their "partners" is blurry from a user POV and completely depends on Amazon's tech working as intended. With a computer it's binary, I am either typing something into the computer or I am not.
  - throwaway2016a 9y ago
    It's pretty clear... - When you say the wake word it starts. - The light is on when it is recording. - Once you say a phrase to activate an app it goes to that app. That last one is a bit fuzzy. "Open APP_NAME", "tell APP_NAME" and a few other phrases will trigger it which may not be all that clear. This change only effects stuff you say after you trigger the app. And if Amazon doesn't obey it AND somehow no one can reverse engineer and detect that they aren't playing by the rules... someone at Amazon will whistle-blow and it will cost the company millions if not billions. Sound the alarms when I developer reports receiving logs of conversations that weren't with their app. There are thousands of developers. One of them has to be honest. The only concern I possibly have is if the governments orders them to activate it as a listening device, but this particular article is not about that. This article is distorting the truth to get clicks. Period.
pansinghkoder 9y ago
I expected better from hackernews. Not from engadget though, read their other articles and you'll know what I mean. It's a clickbait. Alexa records and streams only when you say the wake word. Concerns raised by fellow hackernews users are legit but it's not happening yet.
sharemywin 9y ago
I feel there should be an agent with a fiduciary duty to my best interest.
treebeard901 9y ago
Lots of anti-Amazon news coming out the day after prime day. From alexa spying to the effect Amazon has on rural communities. One article today on CNBC even went so far as to claim Amazon is responsible for the lack of inflation in the wider economy. If history is any guide then expect this negative PR campaign to continue over the coming weeks.

77 points by okket 9y ago

the other day I thought of a secondary device (that's not connected to the internet) that would go along with Alexa or whatever mic-connected device that "somehow" scrambles the sounds so that it's just noise to Alexa until you say the keyword, at which point it unscrambles for some given period of time so Alexa can understand. Is such a device possible?? I don't know, probably not but it would help me feel better about getting one of these devices

chinathrow 9y ago

> It would also raise serious privacy concerns for users. To me, that device class alone raises serious privacy issues.

ocdtrekkie 9y ago
Yeah, I mean, I wanna raise a privacy outrage over this news but like... If you put an Amazon or Google connected microphone in your house... You've already given up your privacy. Who else they share it with is just gravy at that point.
- Retric 9y ago
  I actually want a device like this that does not connect to the internet. So, I can ask for the time while half asleep without opening my eyes and more importantly while keeping my bedroom dark. However the idea of having an always on microphone connected to the internet creeps me out.
  - ocdtrekkie 9y ago
    There's a few open source projects out there. I wouldn't recommend anyone use mine, because its written for my needs. And one of the important parts... Speech recognition... Isn't implemented yet. ;) But I think there's a huge perk to a 'personal' digital assistant... One built for your needs, not a corporation's.
  - ashark 9y ago
    > I actually want a device like this that does not connect to the internet. You won't get a decent one until we outlaw spying on people in exchange for a service. Then plenty will pop up. There's just no point in trying to compete with these services now, and anyone who tried and did even a sort-of OK job would just get snapped up by (or, failing that, mercilessly destroyed by) a bigco and set to working on spying services. FWIW I also think "loyalty card" and CC data collection/selling should be illegal, not just spyvertising Internet services. The standard should be only allowing the bare minimum to make the service work (so CCs would have to collect transaction data, yes), NO selling or sharing, transparency requirements, retention limits, and prohibitions on vertical integrations that allow companies to use what they know against people when trying to sell unrelated goods/services.
- mikeash 9y ago
  Everybody with a cell phone already does this. Why does it seem like this worry is confined to things like the Echo?
  - ocdtrekkie 9y ago
    The biggest difference is cell phones aren't listening for activation words to then transmit audio to the cloud. The chance of accidental activation and transmission is much lower. Yes, there are phones that offer this as a feature, but you'd better believe I won't use those either.
    - mikeash 9y ago
      Cell phones aren't doing this... that you know of. If you don't trust Amazon or Google (and I don't mean to imply that you should!) then it seems like you can't trust them not to lie about when the mic is on.
    - reaperducer 9y ago
      "Hey, Siri" and "OK, Google" disagree.

digitalzombie 9y ago

I mean Amazon erased 1984 from kindle users so yeaaah. This is one more data point in the they don't care about you category.

redm 9y ago

I can't say I'm surprised. Removal of privacy is an ongoing process as we, as users, continue to trade privacy for convenience. After each milestone, we settle in to allow for the next. I don't see this changing, at the end of the day, people value convenience over privacy, even if we yell about it.

deleted 9y ago
[deleted]
ertemplin 9y ago
This isn't removal of privacy. The article even says that the information would be limited to transcripts of interactions for skills that the developer owns. Currently developers can only see what users are trying to do if they successfully invoke a registered "intent". For example: GetHoroscope what is the horoscope for {Sign}. The only information that the developer can currently see is that the user invoked the "What is the horoscope for" intent and provided the "Sign" parameter. This would allow developers to handle all interactions with their skill, not just registered intents.

draw_down 9y ago

Seems like you should go ahead and assume this is happening if you use one.

EduardoBautista 9y ago

Every time I read something like this, I further justify my decision to buy into the Apple ecosystem. They may be proprietary, but they haven't done anything privacy-wise to upset me.

jstanley 9y ago
Every time I read something like this, I further justify my decision not to buy into anybody's ecosystem! Free software and decentralisation is the answer.
- gregjw 9y ago
  Calm down, Stallman.
  - AlexandrB 9y ago
    Stallman is an optimist.
  - jasonkostempski 9y ago
    Rage up, Smith.
- EduardoBautista 9y ago
  If you can give me a reasonable alternative for a smartphone that respects your privacy and doesn't make me live like I did a decade ago, I will switch.
  - jstanley 9y ago
    I run CopperheadOS: https://copperhead.co/android/ https://copperhead.co/android/ It's Android, but without non-free software, and without any reporting to Google.
- the_common_man 9y ago
  I agree that decentralisation is the answer but that software does not need to be 'Free'. It's great if it is but there are hardly any companies that make purely 'Free' (as in freedom) products and make money.

whazor 9y ago

I thought this already happens, as long as your voice app is being called. You have special analytics tooling.

mikeash 9y ago

The headline is missing the part where it's the transcripts of your interactions with that developer's service. They're not handing over your full transcripts of all interaction with the device. Rather misleading. My only reaction to this is that it's kind of weird they weren't already doing it.

throwaway2016a 9y ago
Exactly this. Being able to see what users are actually saying to your chat bot is critical to do development. Without it, it is like trying to debug an issue with a website without being able to see the HTTP access logs. Furthermore, the bot already knows when you say the right things to it, because what command you issued is sent to the developer's lambda endpoint so they can fulfill your request. This is just telling the developer when you say things to their app that weren't properly recognized by the AI. Previously it was like telling a developer: you got this many 404 errors but we won't tell you what page they were on. This is just telling the developer what page.
- snarf21 9y ago
  Yeah, and this is the information that is needed to really move these skills forward. I wish you could set a threshold on the intents based on confidence level and prioritization to have more of a custom fall through logic.
- ceejayoz 9y ago
  I understand entirely the need... but at some point some developer's going to get a transcript that goes "Alexa, order me an Uber." "To where?" "OH NO YOU DON'T ASSHOLE YOU HAD SEX WITH MY COUSIN AND WE'RE GOING TO TALK ABOUT THIS RIGHT NOW".
  - throwaway2016a 9y ago
    While I think that is possible the same is true if I'm on the phone with the dispatcher at a Taxi company and no one is saying the phone company is disrespecting my privacy for sending the full uncensored audio of what I say into the phone to the phone number I called. I actually like that analogy better than the website one I gave... effectively when you activate a bot of any kind you are calling that bot.

__jal 9y ago

Doesn't change anything for me, other than affirm my decision to not bug my own home. These seem like fun toys, but there's no way I'm allowing closed-source surveillance devices that send data to who-knows-where/who, under terms that are mutable by a TOS change nobody ever sees, protected by a firm with interests only sometimes aligned with mine, stored for who knows how long in to my home. Even if you're fine with all the rest and think Amazon/Google/Apple/whoever is perfectly aligned with your interests, the storage aspect should be troubling. In the US, we've been on a steady downward slope of privacy intrusions from our government. Imagine your personal political boogyman in power when the next bad terrorist strike happens and everyone is in freak-out mode. Last time the Patriot act was sitting in a drawer, waiting for the right time. What is in the next version, sitting in a drawer right now?

wukerplank 9y ago
Whenever I saw a dystopian movie/comic where people would willingly put an always on listening device into their homes, I thought: "Never gonna happen!"
- Joe-Z 9y ago
  Because in dystopian movies (your comment reminded me of 'The Fifth Element') they never show the 'but it's just so convenient!'-part. Not arguing for these things, I'd never get one either, but I'm just saying there are (probably?) positive sides to having one as well.
rblatz 9y ago
Odds are you carry one with you everywhere you go.
hbosch 9y ago
Better be quiet, your laptop, TV, cell phone and car are listening...

slg 9y ago

I have a question for anyone who has privacy concerns with these type of devices: do you own a smartphone? Those seem nearly infinitely more dangerous from a privacy standpoint than a smart speaker. First off, you are likely to carry them with you wherever you go instead of being stationary in your home. Secondly they are more technically advanced with additional sensors like GPS and much higher processing power and storage space. And lastly they are much more difficult to completely monitor due to having a network connection that isn't created and operated by the device's owner.

ceejayoz 9y ago
My smartphone is plenty useful even if Siri is turned off, though.
ahelwer 9y ago
Yes, our lives are already privacy dumpster fires. Doesn't mean we should wish the fire to grow.
AlexandrB 9y ago
I think it's the level of intimacy implied by an always-on listening device in your home. While a cellphone can track your location, I think people have adapted to the idea of being tracked in public. What's creepy about smart speakers is that there's now something in your home that can betray the simple privacy of a conversation with a friend. This is something new.
- slg 9y ago
  If you are willing to believe that a smart speaker is compromised to a degree that violates your privacy, why would you believe your cell phone can't be compromised to the same degree? You cell phone is also likely to be present for every "conversation with a friend" at which your smart speaker is present so I think the "intimacy" issue is a red herring.
  - AlexandrB 9y ago
    > If you are willing to believe that a smart speaker is compromised to a degree that violates your privacy IMHO the smart speaker's normal function violates my privacy by recording what I'm saying and sending it to Google/Amazon/Whomever for unspecified data analysis and processing. It doesn't need to be compromised to do so. > You cell phone is also likely to be present for every "conversation with a friend" at which your smart speaker is present so I think the "intimacy" issue is a red herring. You're right, but the perception of privacy is not rational. A modern smartphone's primary interface is not its microphone - at least not yet. A smart speaker's primary interface is its always-on microphone. This is not too dissimilar from how Google Glass was creepy because one of its main features is as a potentially-always-on camera - even though a smartphone also has a camera.

throwaway2016a 9y ago

This comment thread, the thread on the article, and the article itself are so disappointing. I expected more from Hacker News and Engadget. This is fake news and so many people fell for it. And I NEVER use the term fake news, this is literally the first time. Like many cases of fake news it is based on something that is true but either through ignorance or intentional misdirection is drawing and leading people to draw a false conclusion. What is actually happening: - Website app can see an access log of every page you visit on it when previously they could only see successful pages that didn't error or result in a 404. Just instead of a typed URL it is a spoken sentence. - Web app STILL CANNOT access what you requested from other web apps (other Alexa skills). What everyone is ready and the Engadget article strongly implies: - amazon is now sending everything you say to all developers even if you said to to another app Edit: To the one person (so far) who down-voted me and to the others who probably will as well... I'm OK with that. I am willing to sacrifice some HN karma to spread the word that intentionally misleading articles like this are not OK. And coming on Hacker News and allowing yourself to be mislead rather than form your own opinion is also not OK. We deserve better.

AlexandrB 9y ago
> Just instead of a typed URL it is a spoken sentence. This is why I'll never use a smart speaker - the line between when I am and am not subject to Amazon's privacy policy and information sharing with their "partners" is blurry from a user POV and completely depends on Amazon's tech working as intended. With a computer it's binary, I am either typing something into the computer or I am not.
- throwaway2016a 9y ago
  It's pretty clear... - When you say the wake word it starts. - The light is on when it is recording. - Once you say a phrase to activate an app it goes to that app. That last one is a bit fuzzy. "Open APP_NAME", "tell APP_NAME" and a few other phrases will trigger it which may not be all that clear. This change only effects stuff you say after you trigger the app. And if Amazon doesn't obey it AND somehow no one can reverse engineer and detect that they aren't playing by the rules... someone at Amazon will whistle-blow and it will cost the company millions if not billions. Sound the alarms when I developer reports receiving logs of conversations that weren't with their app. There are thousands of developers. One of them has to be honest. The only concern I possibly have is if the governments orders them to activate it as a listening device, but this particular article is not about that. This article is distorting the truth to get clicks. Period.

pansinghkoder 9y ago

I expected better from hackernews. Not from engadget though, read their other articles and you'll know what I mean. It's a clickbait. Alexa records and streams only when you say the wake word. Concerns raised by fellow hackernews users are legit but it's not happening yet.

sharemywin 9y ago

I feel there should be an agent with a fiduciary duty to my best interest.

treebeard901 9y ago

Lots of anti-Amazon news coming out the day after prime day. From alexa spying to the effect Amazon has on rural communities. One article today on CNBC even went so far as to claim Amazon is responsible for the lack of inflation in the wider economy. If history is any guide then expect this negative PR campaign to continue over the coming weeks.