4 ms·

Can we be absolutely certain that everything before “Ok, Google” or “Alexa” isn’t being recorded, by the companies or by back doors created by the security serv

Can we be absolutely certain that everything before “Ok, Google” or “Alexa” isn’t being recorded, by the companies or by back doors created by the security services? Seems too much like a telescreen for my liking. The problem is I would love one I could trust!

craftyguy 9y ago
>Can we be absolutely certain that everything before “Ok, Google” or “Alexa” isn’t being recorded, by the companies or by back doors created by the security services? It's all proprietary, so the answer is: no.
- wepple 9y ago
  Correction: it’s all proprietary, so the answer is: yes; you could reverse engineer firmware
  - twblalock 9y ago
    That won't help you find out if Amazon is storing the recordings in a datacenter somewhere.
    - ehsankia 9y ago
      The question here is if the data is being sent back at all or not. If you can show that either Google or Amazon is saying voice data outside of the command after the hotword, you already have yourself a huge scandal. No voice data without hotword should ever even leave the device.
- echosmith 9y ago
  Amazon releases the on-device source code I believe: Here's the link: https://www.amazon.com/gp/help/customer/display.html?nodeId=201626480 https://www.amazon.com/gp/help/customer/display.html?nodeId=... I personally haven't gone through it, but someone more interested can take a stab at it.
thg 9y ago
You could sniff the network connection and see whether it is sending anything home. Of course you'd have to do that again after every update and you wouldn't know if it doesn't activate silent recording for specific key words. If you want a voice assistant you can trust, you have to build your own out of open hardware and software and run your own hosted service for it, but the thing being hacked would still be a possibility. In the end, the only way to be sure is not to have one in the first place.
- dingaling 9y ago
  > You could sniff the network connection and see whether it is sending anything home Not really practical with a pinned internal CA and batched uploading.
  - thg 9y ago
    > Not really practical with a pinned internal CA and batched uploading. It's not so much about looking at the payload than it is about whether it's sending anything at all and if it is, what amount. Correct me if I'm wrong, but from everything I've read and heard these devices don't really have much in the way of internal storage capacity (yet). It either has to be uploaded or discarded.
    - pdkl95 9y ago
      Are you checking the cellular bands, or just your local 802.{3,11}? SoC exist with builtin LTE/CDMA/etc. edit: Also, voice compresses really well if you don't care about the quality. With a codec that uses <10 kbit/s (e.g. GSM-HR, AMR), the storage requirements are at most 2.4 MB/hour. A simple gate filter that cuts out quiet periods should cut the storage requirements down to only a few MB/week. A typical flash chip used to store the firmware could easily store years worth of typical household speech in the non-firmware space.
      - thg 9y ago
        > SoC exist with builtin LTE/CDMA/etc. But inside the Echo? It's not my area of expertise, but I'm almost certain that there are people with the expertise that are looking for exactly that and if Google or Amazon had those built in, we'd know about it. I think we can at least rule that one out. As for the compression, that is very interesting indeed. I had no idea you could compress voice that much. If / When they're going for 24/7 recording, this would be most likely the way to go and it would be extremely hard, if not impossible, to detect.
toyg 9y ago
> Can we be absolutely certain that everything before “Ok, Google” or “Alexa” isn’t being recorded You can be absolutely certain everything is being recorded, if anything as a statistical datapoint to improve voice recognition. Whether this stuff will get its way to the security services depends almost entirely on whether such services find it useful (the other relevant parameter is the country market-size, i.e. how costly it would be for manufacturers not to comply with requests).
- ataturk 9y ago
  It is argued that the security services pushed for these companies to create these products in the first place. Tinfoil, I know, but the tail does often wag the dog.
mikeash 9y ago
Can you be absolutely sure your phone isn’t recording everything?

craftyguy 9y ago

>Can we be absolutely certain that everything before “Ok, Google” or “Alexa” isn’t being recorded, by the companies or by back doors created by the security services? It's all proprietary, so the answer is: no.

wepple 9y ago
Correction: it’s all proprietary, so the answer is: yes; you could reverse engineer firmware
- twblalock 9y ago
  That won't help you find out if Amazon is storing the recordings in a datacenter somewhere.
  - ehsankia 9y ago
    The question here is if the data is being sent back at all or not. If you can show that either Google or Amazon is saying voice data outside of the command after the hotword, you already have yourself a huge scandal. No voice data without hotword should ever even leave the device.
echosmith 9y ago
Amazon releases the on-device source code I believe: Here's the link: https://www.amazon.com/gp/help/customer/display.html?nodeId=201626480 https://www.amazon.com/gp/help/customer/display.html?nodeId=... I personally haven't gone through it, but someone more interested can take a stab at it.

thg 9y ago

You could sniff the network connection and see whether it is sending anything home. Of course you'd have to do that again after every update and you wouldn't know if it doesn't activate silent recording for specific key words. If you want a voice assistant you can trust, you have to build your own out of open hardware and software and run your own hosted service for it, but the thing being hacked would still be a possibility. In the end, the only way to be sure is not to have one in the first place.

dingaling 9y ago
> You could sniff the network connection and see whether it is sending anything home Not really practical with a pinned internal CA and batched uploading.
- thg 9y ago
  > Not really practical with a pinned internal CA and batched uploading. It's not so much about looking at the payload than it is about whether it's sending anything at all and if it is, what amount. Correct me if I'm wrong, but from everything I've read and heard these devices don't really have much in the way of internal storage capacity (yet). It either has to be uploaded or discarded.
  - pdkl95 9y ago
    Are you checking the cellular bands, or just your local 802.{3,11}? SoC exist with builtin LTE/CDMA/etc. edit: Also, voice compresses really well if you don't care about the quality. With a codec that uses <10 kbit/s (e.g. GSM-HR, AMR), the storage requirements are at most 2.4 MB/hour. A simple gate filter that cuts out quiet periods should cut the storage requirements down to only a few MB/week. A typical flash chip used to store the firmware could easily store years worth of typical household speech in the non-firmware space.
    - thg 9y ago
      > SoC exist with builtin LTE/CDMA/etc. But inside the Echo? It's not my area of expertise, but I'm almost certain that there are people with the expertise that are looking for exactly that and if Google or Amazon had those built in, we'd know about it. I think we can at least rule that one out. As for the compression, that is very interesting indeed. I had no idea you could compress voice that much. If / When they're going for 24/7 recording, this would be most likely the way to go and it would be extremely hard, if not impossible, to detect.

toyg 9y ago

> Can we be absolutely certain that everything before “Ok, Google” or “Alexa” isn’t being recorded You can be absolutely certain everything is being recorded, if anything as a statistical datapoint to improve voice recognition. Whether this stuff will get its way to the security services depends almost entirely on whether such services find it useful (the other relevant parameter is the country market-size, i.e. how costly it would be for manufacturers not to comply with requests).

ataturk 9y ago
It is argued that the security services pushed for these companies to create these products in the first place. Tinfoil, I know, but the tail does often wag the dog.

mikeash 9y ago

Can you be absolutely sure your phone isn’t recording everything?