4 ms·

> They’re a closed source, always on device with a microphone. How do you know it’s not always listening? Your iPhone might be closed-source, but Android devic

by krn 8y ago

> They’re a closed source, always on device with a microphone. How do you know it’s not always listening? Your iPhone might be closed-source, but Android devices can be compiled from source and fully inspected.

grey-area 8y ago
How about the sim card? https://www.scmagazine.com/home/news/black-hat-mobile-carriers-react-quickly-to-major-sim-card-vulnerability/ https://www.scmagazine.com/home/news/black-hat-mobile-carrie...
madhato 8y ago
Android is open source but the Play Store and Play Services are closed source. If Google needed to secretly install a rootkit to listen to the microphone they could.
mikeash 8y ago
I’m pretty sure the cellular baseband in your phone is closed source. Coincidentally, it also has direct access to the microphone and to an internet connection you can’t monitor.
- jschwartzi 8y ago
  Yeah, the baseband processor runs its own independent RTOS with full software control. Without studying, in detail, the electrical connections between the baseband and the rest of the hardware it's not possible to say that it can't record from the microphone independently of the hardware. It's easier to make that argument for the SIM card, which is actually not a SIM card but also a small ARM core that runs Java code. You can embed small programs into the SIM card which is something a lot of carriers do. The SIM card and baseband work in tight concert though and you should just assume that the connections of the baseband are available to the SIM card.
- krn 8y ago
  Sure, but this problem is not specific to cell phones. Any IoT device which uses 2G/3G/4G is similarly vulnerable.
  - mikeash 8y ago
    That just reinforces the point. Why are people so scared of an Echo spying on them but not these other things?
deleted 8y ago
[deleted]
umanwizard 8y ago
Ok, so what? You’ve moved the goalposts. Previously you were comparing Europe to the US, now you’re comparing hardcore privacy geeks willing to tinker with their phones (surely a tiny minority even of Europeans) to all Americans. The vast majority of people both in Europe and the US use stock phones from a mainstream manufacturer without changing the default OS.
- krn 8y ago
  Is it that hard to see how a proprietary always-on home assistant is more invasive to privacy than a personal mobile device, which is not supposed to be listening to anything without an explicit permission?
  - umanwizard 8y ago
    A home assistant is not supposed to be recording anything either, until it hears its power-up word.

by krn 8y ago

grey-area 8y ago

How about the sim card? https://www.scmagazine.com/home/news/black-hat-mobile-carriers-react-quickly-to-major-sim-card-vulnerability/ https://www.scmagazine.com/home/news/black-hat-mobile-carrie...

madhato 8y ago

Android is open source but the Play Store and Play Services are closed source. If Google needed to secretly install a rootkit to listen to the microphone they could.

mikeash 8y ago

I’m pretty sure the cellular baseband in your phone is closed source. Coincidentally, it also has direct access to the microphone and to an internet connection you can’t monitor.

jschwartzi 8y ago
Yeah, the baseband processor runs its own independent RTOS with full software control. Without studying, in detail, the electrical connections between the baseband and the rest of the hardware it's not possible to say that it can't record from the microphone independently of the hardware. It's easier to make that argument for the SIM card, which is actually not a SIM card but also a small ARM core that runs Java code. You can embed small programs into the SIM card which is something a lot of carriers do. The SIM card and baseband work in tight concert though and you should just assume that the connections of the baseband are available to the SIM card.
krn 8y ago
Sure, but this problem is not specific to cell phones. Any IoT device which uses 2G/3G/4G is similarly vulnerable.
- mikeash 8y ago
  That just reinforces the point. Why are people so scared of an Echo spying on them but not these other things?

deleted 8y ago

[deleted]

umanwizard 8y ago

Ok, so what? You’ve moved the goalposts. Previously you were comparing Europe to the US, now you’re comparing hardcore privacy geeks willing to tinker with their phones (surely a tiny minority even of Europeans) to all Americans. The vast majority of people both in Europe and the US use stock phones from a mainstream manufacturer without changing the default OS.

krn 8y ago
Is it that hard to see how a proprietary always-on home assistant is more invasive to privacy than a personal mobile device, which is not supposed to be listening to anything without an explicit permission?
- umanwizard 8y ago
  A home assistant is not supposed to be recording anything either, until it hears its power-up word.