7 ms·

An Alexa Holdout Wants to Know Who’s Listening

techsupporter 9y ago
This is how my better half and I feel about these things. Not only is the idea of having a likely-always-on microphone in our most private space unsettling, the trade-off isn't even worth it for us. But, frankly, neither of us can think of something that would be so Earth-moving as to warrant sticking some perpetual ears all over the place. I don't care if I go to a friend's house and he or she has an Alexa or Home or what-have-you. Their house, their privacy, their rules. But we're keeping them out of ours. (Yes, both of us have disabled Siri and the utility of a mobile phone existing and being indoors with us is higher than the seemingly unlikely trade-off of Apple listening all of the time. "Unlikely" because that's not their business model, so far as I can tell, while All Data Collection Everywhere Always does seem to be the case for Google and Amazon.)
- blacksmith_tb 9y ago
  But they aren't 'always listening' - except for their wake words (yes, I know it's technically possible they really do, and smuggle the data out along with legit requests, but it seems unlikely). So for example the article's author can rest easy if he listens to Barbra Streisand (on vinyl!), Alexa won't be any wiser. Google and Amazon have somewhat different imperatives, Amazon would like to figure how to sell us more things (happily placing orders via the Echo is off by default) while Google would like to figure out how to sell us to more advertisers... (so far blocking keeps that mostly at bay)
  - aosfbbas 9y ago
    I think this is the case during the "ramp up" period where we acquire microphones and video cameras, place them everywhere, and wire them up to a few selected corporations. Phase two is where they decide to make use of them now that they are in place and ubiquitous. For example, they might try to be extra "helpful" and make one of the wake words a very common word.
  - pdkl95 9y ago
    > it's technically possible they really do That's not the problem; it doesn't matter if your particular device is listening at any particular time. Using an always-on microphone normalizes the expectation that audio in the home might be sent to a 3rd party's remote server. This is important because Kyllo v United States created[1] a bright line test for when a technology is a "search". Normalizing audio eavesdropping technology in previously private areas will eventually mean use of that technology is not a search, and thus the police/etc can use their own device with similar technology without a warrant to see "details of a private home that would previously have been unknowable without physical intrusion"[2]. [1] https://news.ycombinator.com/item?id=15853560 https://news.ycombinator.com/item?id=15853560 [2] http://caselaw.findlaw.com/us-supreme-court/533/27.html http://caselaw.findlaw.com/us-supreme-court/533/27.html
  - vintageseltzer 9y ago
    Even if manufacturers behave nicely, there is still the possibility that the devices are eventually somehow compromised by bad actors and used nefariously. For example, the CIA developed and deployed a program to use the built-in microphone on Samsung "smart" TVs to spy on targets, even when it looks like it's off: https://www.theverge.com/2017/3/7/14841556/wikileaks-cia-hacking-documents-ios-android-samsung https://www.theverge.com/2017/3/7/14841556/wikileaks-cia-hac...
    - jjeaff 9y ago
      I would hazard a guess that compromising your phone or laptop to record everything all the time would be easier than an echo.
  - dogecoinbase 9y ago
    But they aren't 'always listening' It's already happened (accidentally, in this case): http://money.cnn.com/2017/10/11/technology/google-home-mini-security-flaw/index.html http://money.cnn.com/2017/10/11/technology/google-home-mini-... And it will continue to happen, because "prevent this from happening at all cost" isn't a development mandate for the device, and won't be, because they would prefer to capture everything. Google famously captured wifi network and street view data after they were specifically instructed not to by the court -- why would they fail to avail themselves of information that's right there in this case?
Erik816 9y ago
It seems insane to me that Amazon wants me to pay them money to put something in my home that will make it far easier to order things from Amazon. That's not even considering all the valuable data they are mining from all the Echo units out there. They should be paying ME for this privilege.
- AndyMcConachie 9y ago
  I have no idea why you were downvoted I completely agree with you.
- matt_the_bass 9y ago
  On the other hand, people are doing just that. So perhaps Amazon is a genius in that regard. Same thing with their key service.
- melling 9y ago
  Why does Google want to sell you the same device? I doubt if I’d buy much more than the basics like paper towels, detergent, etc. Most things require research. Voice as a user interface is a real goal. Let’s hope Amazon vs Google increases functionality. “Alexa, open the garage door, turn on the lights, and set the oven to 350”
- plandis 9y ago
  People have been generally receptive to Alexa/Home, this helps those companies gather additional voice data and supervision from various different people. Plus perhaps they will start making profit on the devices themselves. What is insane about that? It seems like a great business idea, even if you don’t personally like it
  - Erik816 9y ago
    It's not insane for Amazon and Google to sell what people are willing to pay for. I just find it insane that so many people are willing to pay for the privilege of being even more tied into a retailer and probably giving up a fair bit of privacy at the same time. Most people seem to put zero value on that, whereas I would want to be compensated for it. But hey, no accounting for other people's preferences.
vaishaksuresh 9y ago
I'm conflicted about Alexa. I keep it muted most of the time. It is also plugged into a smart outlet that switches it off every night and wakes it up every morning. I still can't shake the feeling of being listened to. Aside from the initial excitement, now all i use it for is turning on and off smart things and playing occasion music from spotify. I might just get rid of it soon.
- philsnow 9y ago
  I've thought that it would be nice to have some actual assurance that the thing is not listening. Your post put it into my mind that you could hook it up to a Clapper https://www.youtube.com/watch?v=3lBWjLJeKkQ https://www.youtube.com/watch?v=3lBWjLJeKkQ and then you wouldn't need to be physically near it to turn it on, say "alexa wyd" and then turn it off. But then, this is 2017 and batteries are light, tiny, and very powerful, so you would still want to take apart the physical device that got shipped to you to verify that it doesn't have batteries in there.
- shagie 9y ago
  Toss a network sniffer in and see what traffic is going from the echo device out and when. Probably won’t see the contents in a meaningful way, but will be able to see how much and when. Open it up. Check to see if there is a signal from the microphone to the main board when the mute button is enabled. Or trust one of the tear down videos. https://www.reddit.com/r/amazonecho/comments/5lc5q5/effectiveness_of_mute_button/ https://www.reddit.com/r/amazonecho/comments/5lc5q5/effectiv...
thomastjeffery 9y ago
If it was totally open-source, if I could easily make it run a different binary, and if I could change the wake-word, it might become appealing. Unfortunately, Alexa, Google Home/Assistant, Cortana, and Siri each fit none of those requirements. I hear Mozilla is working on a speech recognition library. That might be workable. It's crazy to me how much trust some people have in these systems. People on the whole seem to have totally given up on the idea of digital privacy, and I find that very concerning.
- iamthirsty 9y ago
  It's the Privacy v. Convenience trade off. The conveniences are promoted, the privacy implications shrugged off, and in the end you pay someone money to invade your home 24 hours a day. It's a simple but scary formula that doesn't make me optimistic for the future.
  - thomastjeffery 9y ago
    I think the biggest ways we can combat this formula are: 1. Fight DRM. DRM is a pipe-dream enforced by law (DMCA Section 1201 2. Promote Free Software. Proprietary software does not deserve our data.
    - tfha 9y ago
      At some point we will have to embrace full loss of privacy. Today, only the rich and powerful have mass surveillance capabilities. But if we embrace surveillance, we can give that power to everyone. It's much harder to do selective enforcement when the same strategies can be turned on the prosecutor.
      - mulmen 9y ago
        I disagree with this solution. Privacy has utility and when you give it up you do lose something. Even if we give it up to each other we are still in a worse place.
imgabe 9y ago
This is an interesting way to frame things. An "Alexa holdout". This implies that the person who does not want an Alexa is some strange outlier. That everyone else is already doing it, and if you don't want to do it, you're weird, and what's your deal? We need to write a whole newspaper article about this weird person who doesn't want Alexa.
khedoros1 9y ago
I like the idea of having something like the Star Trek computer at home. I can ask it questions, instruct it to do things, and so on. I get the allure, at least in theory. I've got Google, Apple, and Microsoft phones around, but none are set to answer to wake words. Cortana on my laptop is as shut-off as possible. They all need to be manually-initiated. Transmitting voice without taking a direct, physical action is basically where I draw the line. After all, typing something into a search engine needs a sequence of specific actions. I think that the extra barrier provides the psychological comfort I need. It's easy to sound like a luddite nutter worrying about some vague conspiracy. On the other hand, it feels like a lot of companies are getting good practice at boiling frogs, slowly re-framing what most of society thinks of as its comfort zone, concerning technology like this.
- tomrod 9y ago
  It seems like giving a direct, non-voice command makes sense. I'm thinking of a repurposed Amazon Dash button[0] embedded in a watch, perhaps in a smartwatch app, or glasses, or key fob. The general flow of "doing things" has almost always had a specific turn-on function -- starting a car, opening a browser, kicking off a work project, and so on. Rarely should things maintain a holding pattern. [0] https://www.digikey.com/en/maker/blogs/amazon-dash-button-tear-down/5d888fe1e3a641f5890d7265334df690 https://www.digikey.com/en/maker/blogs/amazon-dash-button-te...
  - shagie 9y ago
    Aside from pull and push - there's another model of information. Ambient. The Ambient orb ( http://www.ambientdevices.com http://www.ambientdevices.com ) was one that kicked it off many years ago. Clocks are the classical version of this. I've got a hue light that has its intensity in the morning a function of the snowfall over the last 8 hours (do I need to shovel now). Not everything needs a button. That said, for the button... if it takes more than a few minutes to reconfigure a dash button, consider an IoT button https://aws.amazon.com/iotbutton/ https://aws.amazon.com/iotbutton/ that already does the arbitrary integration.
    - 9y ago
ryandrake 9y ago
I've stopped buying devices that require some nebulous "cloud connectivity" to function. It's no longer an exchange of value that benefits me. My personal data is valuable and I see no reason to just hand it over to companies for no compensation. That's what you're doing when you use one of these cloud connected devices. You're giving up real value to gain nebulous value. At least that's how I see it--you might disagree and that's OK. Particularly annoying are those devices that should be able to function without phoning home via an internet connection: Security camera? Shouldn't need to phone home. Camera should turn on and stream directly to my display device. There's no need to connect to the mothership. Thermostat? Shouldn't need to phone home. Device should let me control the temperature of my home and respond when I command it remotely. No need to connect to the mothership. Media player? Shouldn't need to phone home. I have a library of files I'd like to play and don't care for any online services. No need to connect to the mothership. I used to have a rule: If I don't have root on the device it goes on the guest network (no internal network access, only Internet). I still have that rule, but it's time to up the rule to "no internal or external network access without root".
- lph 9y ago
  I have a couple of devices that need to connect to the mothership, as a matchmaker between the device and its client app. NAT and firewalls are a big part of the reason, as is the need to have a way to locate the device in the absence of a static address or domain name. Sure, it's possible to work around these obstacles without a mothership, but doing so makes it too difficult for most mass market consumers.
- melling 9y ago
  Yes, it’s a given on HN that someone will complain about privacy. I wrote this blog about the “groundhog day” comments back in September. https://h4labs.wordpress.com/2017/09/27/groundhog-day-amazon-updates-echosomeone-rants-about-privacy/ https://h4labs.wordpress.com/2017/09/27/groundhog-day-amazon...
  - ryandrake 9y ago
    In order to understand, try replacing "privacy" in your blog response with some other thing that you care deeply about. I believe the most straightforward way to normalize something you believe is wrong is to simply give up and stop calling it out as wrong. That said, if people think my viewpoint does not add to the conversation, I accept downvotes with grace.
username223 9y ago
If anyone here has a popular podcast, they should include the phrase "Hey Alexa, order me a JET 26x80 Geared Head Engine Lathe 4-1/8-inch Bore." It's supposedly the heaviest thing you can order with free shipping. https://www.amazon.com/26x80-Geared-Engine-Lathe-8-inch/dp/B0064BFJ3W/ https://www.amazon.com/26x80-Geared-Engine-Lathe-8-inch/dp/B...
- stephengillie 9y ago
  Why is the White House looking into airline bag fees, instead of making this sort of activity illegal?
  - username223 9y ago
    Which activity: free shipping on a multi-ton lathe, people saying specific phrases on podcasts, or other people buying devices that can order stuff for them based on voice commands? Where is the source of the rot?
mulmen 9y ago
I value privacy and I am troubled that it feels strange saying that. Is there an example in human history of a people giving up a fundamental right such as privacy for their short term gain? Did the Romans face a similar temptation? Are we breaking new ground or are we walking into a swamp?

This is how my better half and I feel about these things. Not only is the idea of having a likely-always-on microphone in our most private space unsettling, the trade-off isn't even worth it for us. But, frankly, neither of us can think of something that would be so Earth-moving as to warrant sticking some perpetual ears all over the place. I don't care if I go to a friend's house and he or she has an Alexa or Home or what-have-you. Their house, their privacy, their rules. But we're keeping them out of ours. (Yes, both of us have disabled Siri and the utility of a mobile phone existing and being indoors with us is higher than the seemingly unlikely trade-off of Apple listening all of the time. "Unlikely" because that's not their business model, so far as I can tell, while All Data Collection Everywhere Always does seem to be the case for Google and Amazon.)

blacksmith_tb 9y ago
But they aren't 'always listening' - except for their wake words (yes, I know it's technically possible they really do, and smuggle the data out along with legit requests, but it seems unlikely). So for example the article's author can rest easy if he listens to Barbra Streisand (on vinyl!), Alexa won't be any wiser. Google and Amazon have somewhat different imperatives, Amazon would like to figure how to sell us more things (happily placing orders via the Echo is off by default) while Google would like to figure out how to sell us to more advertisers... (so far blocking keeps that mostly at bay)
- aosfbbas 9y ago
  I think this is the case during the "ramp up" period where we acquire microphones and video cameras, place them everywhere, and wire them up to a few selected corporations. Phase two is where they decide to make use of them now that they are in place and ubiquitous. For example, they might try to be extra "helpful" and make one of the wake words a very common word.
- pdkl95 9y ago
  > it's technically possible they really do That's not the problem; it doesn't matter if your particular device is listening at any particular time. Using an always-on microphone normalizes the expectation that audio in the home might be sent to a 3rd party's remote server. This is important because Kyllo v United States created[1] a bright line test for when a technology is a "search". Normalizing audio eavesdropping technology in previously private areas will eventually mean use of that technology is not a search, and thus the police/etc can use their own device with similar technology without a warrant to see "details of a private home that would previously have been unknowable without physical intrusion"[2]. [1] https://news.ycombinator.com/item?id=15853560 https://news.ycombinator.com/item?id=15853560 [2] http://caselaw.findlaw.com/us-supreme-court/533/27.html http://caselaw.findlaw.com/us-supreme-court/533/27.html
- vintageseltzer 9y ago
  Even if manufacturers behave nicely, there is still the possibility that the devices are eventually somehow compromised by bad actors and used nefariously. For example, the CIA developed and deployed a program to use the built-in microphone on Samsung "smart" TVs to spy on targets, even when it looks like it's off: https://www.theverge.com/2017/3/7/14841556/wikileaks-cia-hacking-documents-ios-android-samsung https://www.theverge.com/2017/3/7/14841556/wikileaks-cia-hac...
  - jjeaff 9y ago
    I would hazard a guess that compromising your phone or laptop to record everything all the time would be easier than an echo.
- dogecoinbase 9y ago
  But they aren't 'always listening' It's already happened (accidentally, in this case): http://money.cnn.com/2017/10/11/technology/google-home-mini-security-flaw/index.html http://money.cnn.com/2017/10/11/technology/google-home-mini-... And it will continue to happen, because "prevent this from happening at all cost" isn't a development mandate for the device, and won't be, because they would prefer to capture everything. Google famously captured wifi network and street view data after they were specifically instructed not to by the court -- why would they fail to avail themselves of information that's right there in this case?

Erik816 9y ago

It seems insane to me that Amazon wants me to pay them money to put something in my home that will make it far easier to order things from Amazon. That's not even considering all the valuable data they are mining from all the Echo units out there. They should be paying ME for this privilege.

AndyMcConachie 9y ago
I have no idea why you were downvoted I completely agree with you.
matt_the_bass 9y ago
On the other hand, people are doing just that. So perhaps Amazon is a genius in that regard. Same thing with their key service.
melling 9y ago
Why does Google want to sell you the same device? I doubt if I’d buy much more than the basics like paper towels, detergent, etc. Most things require research. Voice as a user interface is a real goal. Let’s hope Amazon vs Google increases functionality. “Alexa, open the garage door, turn on the lights, and set the oven to 350”
plandis 9y ago
People have been generally receptive to Alexa/Home, this helps those companies gather additional voice data and supervision from various different people. Plus perhaps they will start making profit on the devices themselves. What is insane about that? It seems like a great business idea, even if you don’t personally like it
- Erik816 9y ago
  It's not insane for Amazon and Google to sell what people are willing to pay for. I just find it insane that so many people are willing to pay for the privilege of being even more tied into a retailer and probably giving up a fair bit of privacy at the same time. Most people seem to put zero value on that, whereas I would want to be compensated for it. But hey, no accounting for other people's preferences.

vaishaksuresh 9y ago

I'm conflicted about Alexa. I keep it muted most of the time. It is also plugged into a smart outlet that switches it off every night and wakes it up every morning. I still can't shake the feeling of being listened to. Aside from the initial excitement, now all i use it for is turning on and off smart things and playing occasion music from spotify. I might just get rid of it soon.

philsnow 9y ago
I've thought that it would be nice to have some actual assurance that the thing is not listening. Your post put it into my mind that you could hook it up to a Clapper https://www.youtube.com/watch?v=3lBWjLJeKkQ https://www.youtube.com/watch?v=3lBWjLJeKkQ and then you wouldn't need to be physically near it to turn it on, say "alexa wyd" and then turn it off. But then, this is 2017 and batteries are light, tiny, and very powerful, so you would still want to take apart the physical device that got shipped to you to verify that it doesn't have batteries in there.
shagie 9y ago
Toss a network sniffer in and see what traffic is going from the echo device out and when. Probably won’t see the contents in a meaningful way, but will be able to see how much and when. Open it up. Check to see if there is a signal from the microphone to the main board when the mute button is enabled. Or trust one of the tear down videos. https://www.reddit.com/r/amazonecho/comments/5lc5q5/effectiveness_of_mute_button/ https://www.reddit.com/r/amazonecho/comments/5lc5q5/effectiv...

thomastjeffery 9y ago

If it was totally open-source, if I could easily make it run a different binary, and if I could change the wake-word, it might become appealing. Unfortunately, Alexa, Google Home/Assistant, Cortana, and Siri each fit none of those requirements. I hear Mozilla is working on a speech recognition library. That might be workable. It's crazy to me how much trust some people have in these systems. People on the whole seem to have totally given up on the idea of digital privacy, and I find that very concerning.

iamthirsty 9y ago
It's the Privacy v. Convenience trade off. The conveniences are promoted, the privacy implications shrugged off, and in the end you pay someone money to invade your home 24 hours a day. It's a simple but scary formula that doesn't make me optimistic for the future.
- thomastjeffery 9y ago
  I think the biggest ways we can combat this formula are: 1. Fight DRM. DRM is a pipe-dream enforced by law (DMCA Section 1201 2. Promote Free Software. Proprietary software does not deserve our data.
  - tfha 9y ago
    At some point we will have to embrace full loss of privacy. Today, only the rich and powerful have mass surveillance capabilities. But if we embrace surveillance, we can give that power to everyone. It's much harder to do selective enforcement when the same strategies can be turned on the prosecutor.
    - mulmen 9y ago
      I disagree with this solution. Privacy has utility and when you give it up you do lose something. Even if we give it up to each other we are still in a worse place.

imgabe 9y ago

This is an interesting way to frame things. An "Alexa holdout". This implies that the person who does not want an Alexa is some strange outlier. That everyone else is already doing it, and if you don't want to do it, you're weird, and what's your deal? We need to write a whole newspaper article about this weird person who doesn't want Alexa.

khedoros1 9y ago

I like the idea of having something like the Star Trek computer at home. I can ask it questions, instruct it to do things, and so on. I get the allure, at least in theory. I've got Google, Apple, and Microsoft phones around, but none are set to answer to wake words. Cortana on my laptop is as shut-off as possible. They all need to be manually-initiated. Transmitting voice without taking a direct, physical action is basically where I draw the line. After all, typing something into a search engine needs a sequence of specific actions. I think that the extra barrier provides the psychological comfort I need. It's easy to sound like a luddite nutter worrying about some vague conspiracy. On the other hand, it feels like a lot of companies are getting good practice at boiling frogs, slowly re-framing what most of society thinks of as its comfort zone, concerning technology like this.

tomrod 9y ago
It seems like giving a direct, non-voice command makes sense. I'm thinking of a repurposed Amazon Dash button[0] embedded in a watch, perhaps in a smartwatch app, or glasses, or key fob. The general flow of "doing things" has almost always had a specific turn-on function -- starting a car, opening a browser, kicking off a work project, and so on. Rarely should things maintain a holding pattern. [0] https://www.digikey.com/en/maker/blogs/amazon-dash-button-tear-down/5d888fe1e3a641f5890d7265334df690 https://www.digikey.com/en/maker/blogs/amazon-dash-button-te...
- shagie 9y ago
  Aside from pull and push - there's another model of information. Ambient. The Ambient orb ( http://www.ambientdevices.com http://www.ambientdevices.com ) was one that kicked it off many years ago. Clocks are the classical version of this. I've got a hue light that has its intensity in the morning a function of the snowfall over the last 8 hours (do I need to shovel now). Not everything needs a button. That said, for the button... if it takes more than a few minutes to reconfigure a dash button, consider an IoT button https://aws.amazon.com/iotbutton/ https://aws.amazon.com/iotbutton/ that already does the arbitrary integration.
  - 9y ago

ryandrake 9y ago

I've stopped buying devices that require some nebulous "cloud connectivity" to function. It's no longer an exchange of value that benefits me. My personal data is valuable and I see no reason to just hand it over to companies for no compensation. That's what you're doing when you use one of these cloud connected devices. You're giving up real value to gain nebulous value. At least that's how I see it--you might disagree and that's OK. Particularly annoying are those devices that should be able to function without phoning home via an internet connection: Security camera? Shouldn't need to phone home. Camera should turn on and stream directly to my display device. There's no need to connect to the mothership. Thermostat? Shouldn't need to phone home. Device should let me control the temperature of my home and respond when I command it remotely. No need to connect to the mothership. Media player? Shouldn't need to phone home. I have a library of files I'd like to play and don't care for any online services. No need to connect to the mothership. I used to have a rule: If I don't have root on the device it goes on the guest network (no internal network access, only Internet). I still have that rule, but it's time to up the rule to "no internal or external network access without root".

lph 9y ago
I have a couple of devices that need to connect to the mothership, as a matchmaker between the device and its client app. NAT and firewalls are a big part of the reason, as is the need to have a way to locate the device in the absence of a static address or domain name. Sure, it's possible to work around these obstacles without a mothership, but doing so makes it too difficult for most mass market consumers.
melling 9y ago
Yes, it’s a given on HN that someone will complain about privacy. I wrote this blog about the “groundhog day” comments back in September. https://h4labs.wordpress.com/2017/09/27/groundhog-day-amazon-updates-echosomeone-rants-about-privacy/ https://h4labs.wordpress.com/2017/09/27/groundhog-day-amazon...
- ryandrake 9y ago
  In order to understand, try replacing "privacy" in your blog response with some other thing that you care deeply about. I believe the most straightforward way to normalize something you believe is wrong is to simply give up and stop calling it out as wrong. That said, if people think my viewpoint does not add to the conversation, I accept downvotes with grace.

username223 9y ago

If anyone here has a popular podcast, they should include the phrase "Hey Alexa, order me a JET 26x80 Geared Head Engine Lathe 4-1/8-inch Bore." It's supposedly the heaviest thing you can order with free shipping. https://www.amazon.com/26x80-Geared-Engine-Lathe-8-inch/dp/B0064BFJ3W/ https://www.amazon.com/26x80-Geared-Engine-Lathe-8-inch/dp/B...

stephengillie 9y ago
Why is the White House looking into airline bag fees, instead of making this sort of activity illegal?
- username223 9y ago
  Which activity: free shipping on a multi-ton lathe, people saying specific phrases on podcasts, or other people buying devices that can order stuff for them based on voice commands? Where is the source of the rot?

mulmen 9y ago

I value privacy and I am troubled that it feels strange saying that. Is there an example in human history of a people giving up a fundamental right such as privacy for their short term gain? Did the Romans face a similar temptation? Are we breaking new ground or are we walking into a swamp?