4 ms·

They’re a closed source, always on device with a microphone. How do you know it’s not always listening? The point is, they subject you to the same threat as an

by dymk 8y ago

They’re a closed source, always on device with a microphone. How do you know it’s not always listening? The point is, they subject you to the same threat as an Alexa. You can’t say “Europeans don’t use Alexa because it could XYZ”, and yet they use phones which could also do XYZ.

krn 8y ago
> They’re a closed source, always on device with a microphone. How do you know it’s not always listening? Your iPhone might be closed-source, but Android devices can be compiled from source and fully inspected.
- grey-area 8y ago
  How about the sim card? https://www.scmagazine.com/home/news/black-hat-mobile-carriers-react-quickly-to-major-sim-card-vulnerability/ https://www.scmagazine.com/home/news/black-hat-mobile-carrie...
- madhato 8y ago
  Android is open source but the Play Store and Play Services are closed source. If Google needed to secretly install a rootkit to listen to the microphone they could.
- mikeash 8y ago
  I’m pretty sure the cellular baseband in your phone is closed source. Coincidentally, it also has direct access to the microphone and to an internet connection you can’t monitor.
  - jschwartzi 8y ago
    Yeah, the baseband processor runs its own independent RTOS with full software control. Without studying, in detail, the electrical connections between the baseband and the rest of the hardware it's not possible to say that it can't record from the microphone independently of the hardware. It's easier to make that argument for the SIM card, which is actually not a SIM card but also a small ARM core that runs Java code. You can embed small programs into the SIM card which is something a lot of carriers do. The SIM card and baseband work in tight concert though and you should just assume that the connections of the baseband are available to the SIM card.
  - krn 8y ago
    Sure, but this problem is not specific to cell phones. Any IoT device which uses 2G/3G/4G is similarly vulnerable.
    - mikeash 8y ago
      That just reinforces the point. Why are people so scared of an Echo spying on them but not these other things?
- deleted 8y ago
  [deleted]
- umanwizard 8y ago
  Ok, so what? You’ve moved the goalposts. Previously you were comparing Europe to the US, now you’re comparing hardcore privacy geeks willing to tinker with their phones (surely a tiny minority even of Europeans) to all Americans. The vast majority of people both in Europe and the US use stock phones from a mainstream manufacturer without changing the default OS.
  - krn 8y ago
    Is it that hard to see how a proprietary always-on home assistant is more invasive to privacy than a personal mobile device, which is not supposed to be listening to anything without an explicit permission?
    - umanwizard 8y ago
      A home assistant is not supposed to be recording anything either, until it hears its power-up word.
the_watcher 8y ago
RE: We have an illusion of control, but do you know exactly what's going on inside the slab of black mirror? I guess this is true (for most people, it's definitely true in practice), but the difference with Echo's is that it's not just that it's _possible_ that the device is listening and recording, it's that those are proudly displayed as critical _features_ of the product. We worry about things like "the apps on my phone could be secretly recording me", but then buy Echos, Google Home's, etc, all of which require "always listening" to function at all. NOTE: I own an Echo and love it, despite being otherwise fairly privacy conscious (I know that these two statements are wildly inconsistent).
- terandle 8y ago
  Cell phones have the same always listening features like Hey Siri, Ok Google, etc.
- close04 8y ago
  One difference could be that if you discover your phone is listening and sending data that's a scandal right there while digital assistants do it by design. It simply lowers the bar to you being spied on, all else being equal.
  - umanwizard 8y ago
    Uh, no, my echo “by design” only starts recording after it hears the word “Alexa”. Sure it’s possible that that’s a lie, but that’s a different question.
  - judofyr 8y ago
    > One difference could be that if you discover your phone is listening and sending data that's a scandal right there while digital assistants do it by design. What do you mean? All digital assistants I know about use a wake word and they all seem to respect it very seriously: - Incidents where the assistant has misheard the wake word causes headlines across the Internet and there's always a reply from an official spokesperson (e.g: https://www.theverge.com/2018/5/24/17391898/amazon-alexa-private-conversation-recording-explanation https://www.theverge.com/2018/5/24/17391898/amazon-alexa-pri...) - When Google Home Mini had a (hardware) bug where the button could cause it to record all the time, Google issued a software update which disabled the button completely. For months the button was a no-op. https://www.cnet.com/news/google-dumps-home-minis-top-touch-function-over-privacy/ https://www.cnet.com/news/google-dumps-home-minis-top-touch-... - In the Google Home app you can see all recordings that the device has done, play them back, and see how it was interpreted. It's pretty clear that they want to be transparent about what the device does. All in all it seems to me that Google/Amazon is aware that a "we record everything"-scandal can be devastating for the product.
badrabbit 8y ago
Even if they listen,you can monitor network traffic and find out for sure. The difference is a home assistant should send your recording and metadata while a smartphone with similar network activity would be suspicious. Anyways,this is one if those problems that should be addressed in criminal law. Unfortunately most law is retroactively created,this means society will have to face irreversible damage of technology abuse before laws are updated.

by dymk 8y ago

krn 8y ago

> They’re a closed source, always on device with a microphone. How do you know it’s not always listening? Your iPhone might be closed-source, but Android devices can be compiled from source and fully inspected.

grey-area 8y ago
How about the sim card? https://www.scmagazine.com/home/news/black-hat-mobile-carriers-react-quickly-to-major-sim-card-vulnerability/ https://www.scmagazine.com/home/news/black-hat-mobile-carrie...
madhato 8y ago
Android is open source but the Play Store and Play Services are closed source. If Google needed to secretly install a rootkit to listen to the microphone they could.
mikeash 8y ago
I’m pretty sure the cellular baseband in your phone is closed source. Coincidentally, it also has direct access to the microphone and to an internet connection you can’t monitor.
- jschwartzi 8y ago
  Yeah, the baseband processor runs its own independent RTOS with full software control. Without studying, in detail, the electrical connections between the baseband and the rest of the hardware it's not possible to say that it can't record from the microphone independently of the hardware. It's easier to make that argument for the SIM card, which is actually not a SIM card but also a small ARM core that runs Java code. You can embed small programs into the SIM card which is something a lot of carriers do. The SIM card and baseband work in tight concert though and you should just assume that the connections of the baseband are available to the SIM card.
- krn 8y ago
  Sure, but this problem is not specific to cell phones. Any IoT device which uses 2G/3G/4G is similarly vulnerable.
  - mikeash 8y ago
    That just reinforces the point. Why are people so scared of an Echo spying on them but not these other things?
deleted 8y ago
[deleted]
umanwizard 8y ago
Ok, so what? You’ve moved the goalposts. Previously you were comparing Europe to the US, now you’re comparing hardcore privacy geeks willing to tinker with their phones (surely a tiny minority even of Europeans) to all Americans. The vast majority of people both in Europe and the US use stock phones from a mainstream manufacturer without changing the default OS.
- krn 8y ago
  Is it that hard to see how a proprietary always-on home assistant is more invasive to privacy than a personal mobile device, which is not supposed to be listening to anything without an explicit permission?
  - umanwizard 8y ago
    A home assistant is not supposed to be recording anything either, until it hears its power-up word.

the_watcher 8y ago

RE: We have an illusion of control, but do you know exactly what's going on inside the slab of black mirror? I guess this is true (for most people, it's definitely true in practice), but the difference with Echo's is that it's not just that it's _possible_ that the device is listening and recording, it's that those are proudly displayed as critical _features_ of the product. We worry about things like "the apps on my phone could be secretly recording me", but then buy Echos, Google Home's, etc, all of which require "always listening" to function at all. NOTE: I own an Echo and love it, despite being otherwise fairly privacy conscious (I know that these two statements are wildly inconsistent).

terandle 8y ago
Cell phones have the same always listening features like Hey Siri, Ok Google, etc.
close04 8y ago
One difference could be that if you discover your phone is listening and sending data that's a scandal right there while digital assistants do it by design. It simply lowers the bar to you being spied on, all else being equal.
- umanwizard 8y ago
  Uh, no, my echo “by design” only starts recording after it hears the word “Alexa”. Sure it’s possible that that’s a lie, but that’s a different question.
- judofyr 8y ago
  > One difference could be that if you discover your phone is listening and sending data that's a scandal right there while digital assistants do it by design. What do you mean? All digital assistants I know about use a wake word and they all seem to respect it very seriously: - Incidents where the assistant has misheard the wake word causes headlines across the Internet and there's always a reply from an official spokesperson (e.g: https://www.theverge.com/2018/5/24/17391898/amazon-alexa-private-conversation-recording-explanation https://www.theverge.com/2018/5/24/17391898/amazon-alexa-pri...) - When Google Home Mini had a (hardware) bug where the button could cause it to record all the time, Google issued a software update which disabled the button completely. For months the button was a no-op. https://www.cnet.com/news/google-dumps-home-minis-top-touch-function-over-privacy/ https://www.cnet.com/news/google-dumps-home-minis-top-touch-... - In the Google Home app you can see all recordings that the device has done, play them back, and see how it was interpreted. It's pretty clear that they want to be transparent about what the device does. All in all it seems to me that Google/Amazon is aware that a "we record everything"-scandal can be devastating for the product.

badrabbit 8y ago

Even if they listen,you can monitor network traffic and find out for sure. The difference is a home assistant should send your recording and metadata while a smartphone with similar network activity would be suspicious. Anyways,this is one if those problems that should be addressed in criminal law. Unfortunately most law is retroactively created,this means society will have to face irreversible damage of technology abuse before laws are updated.