5 ms·

1) Nobody can prove that. It's always listening and you have to assume always recording and transmitting. 2) My phone is a $12 throw away that speaks voice an

1) Nobody can prove that. It's always listening and you have to assume always recording and transmitting. 2) My phone is a $12 throw away that speaks voice and sms (text). 3) Loose lips sink ships.

ryanmercer 8y ago
> Nobody can prove that. It's always listening and you have to assume always recording and transmitting Uh... packet analyzers, IP logs, bandwidth monitoring tools etc... If instead of transmitting occasional bursts of data when you say the wake word it's been sending back tens of megabytes an hour, or tens to hundreds of megabytes a day, you can go "hey, it's probably transmitting everything it hears". There are people that religiously watch what these devices are sending back just to try and catch one of the companies doing something fishy. There are people that religiously watch their network traffic period looking for something nefarious. These devices aren't like your phone, where simply having it on can have all sorts of services/apps using data in the background or you open a webpage and tens or even hundreds of different servers are contacted and data pulled/pushed to/from them. It's a device that should be periodically checking for an update and sending very small audio files back in nearly-real time. If they were recording regularly, or especially all the time, and transmitting it back to a server it would stand out like a sore thumb. Never mind the fact that keeping it secret, and not having a whistle blower, would be damn impossible. Someone's going to mention it to a loved one or friend, or flat out go online "I discovered my Amazon/Google device is actively listening and recording and sending to these IPs in these intervals" when they just know it as fact and didn't have to 'discover' it.
- LinuxBender 8y ago
  Which nobody can do. It is encrypted and unless the device accept invalid certs, they can queue up, compress, batch upload any data they want. They control the security, not the end-luser.
  - y04nn 8y ago
    Encrypted or not, an audio stream should not be difficult to identify.
    - LinuxBender 8y ago
      If they batch compress and upload, it wont be a stream. It could be aes-256 lzma2 compressed chunks. Using the right codec, they could likely upload a hour of audio in a few hundred kbytes. I have seen some demos of highly bw optimized codecs. Here are some staring points. [1] I would go with Opus. My voice chat server uses that. [1] - https://stackoverflow.com/questions/167533/best-voice-compression-algorithms-formats https://stackoverflow.com/questions/167533/best-voice-compre...
      - vinkelhake 8y ago
        > Using the right codec, they could likely upload a hour of audio in a few hundred kbytes. But at the same time, you're convinced that you would notice if your phone was slipping out these kilobytes as part of its usual communication? It seems to me that you've just arbitrarily picked a level of paranoia where you've decided that this can definitely happen with the Alexa, but won't happen with your phone. Your proud paranoia isn't applied consistently.
        LinuxBender 8y ago
        I am not convinced of anything. The risk of the throw away device uploading my audio is significantly lower than a device powered in my home, with dedicated fast internet.
    - cc439 8y ago
      What if they convert speech to text like the American intel agencies do as proved by the Snowden and Vault 7 leaks?
      - ryanmercer 8y ago
- jakeogh 8y ago
  Can you MITM SSL the conversations to Amazon? It has memory. There is no requirement that it transmits in real time.
Klathmon 8y ago
If we are playing the "you can't prove that" game, then you also can't prove that your $12 throw away phone isn't always recording, or that you new kitchen countertop doesn't have a recording device embedded in it, or that the maker of whatever device you are using to type that comment isn't breaking a plethora of laws to record everything you type or say or do around that device at any time.
- LinuxBender 8y ago
  When my throw away phone is transmitting, it gets warm. I also set it next to an amplifier and I can actually hear it bleed into the amp when it chats with the cell site. I can even tell a couple of seconds ahead of time when I am getting a text or a phone call.
  - recursive 8y ago
    > When my throw away phone is transmitting, it gets warm Maybe that's just what they want you to think so you don't dig any deeper.
  - jedberg 8y ago
    Yeah, but you can also do the same with the Alexa device by watching it transmit data over the wire. If you think watching the transmissions is enough to prove your cell phone isn't recording, then it should be enough to prove the Alexa isn't recording. Or not be sufficient in both cases.
  - Klathmon 8y ago
    And all a hypothetical "bug" needs to do is listen for some key phrases, and send a single byte or a few bytes of data across the wire, even through side channels. I can imagine a system that throws an extra byte or 2 on those "chats" with the cell tower, or even abuses the timing that it decides to reach out and check the tower as the method of communication. The actual voice recording and processing tech is small enough that it could be thrown right alongside the actual phone, for pretty cheap, and could run entirely separate from the phone itself, maybe even having its own battery!
- 8y ago
jedberg 8y ago
> Nobody can prove that. You guys are way to paranoid. They're a public company and they are constantly under audit. They have explicitly stated in their white papers that the device has two computers, one that just listens for the "Alexa" keyword that activates the other one for signal processing. Do you really think they would lie on those white papers? The government would be so far up their ass with fines it would be ridiculous. Not to mention people have actually done tear downs of the device and you can see the two computers and monitor the power input to each one as it runs. The "dumb" computer with minimal memory would be having to store hours of speech data until you say the keyword so it can transmit to the other computer.
- LinuxBender 8y ago
  Audits of controls are about ensuring the longevity of the business. They are entirely orthogonal to ethics or business models. And yes, I am proudly paranoid. History and experience have confirmed the need for my paranoia for many decades.
  - jedberg 8y ago
    > Audits of controls are about ensuring the longevity of the business. You must not have suffered a SOX audit before. Part of the audit is technical. Also, the SEC greatly frowns upon lying about your business.
    - LinuxBender 8y ago
      I have suffered every kind of audit, many times. I know of many technical facets of every business I worked for that would never have been a part of any of those audits. Do you know of any published Amazon audits that describe in detail what specifically around Alexa is audited, if anything?
- aero142 8y ago
  Yes, but is that behavior changeable with only a software update?
- 8y ago
briandear 8y ago
And your SMS is logged as well as cell towers to which you connect. Is the “phone company” more secure than any other? If you really are someone in need of a tin foil hat, you should ditch the phone completely and communicate solely with dead drops and one-time pads.
- jakeogh 8y ago
  Fun to watch the venerable "tin foil hat" lose it's luster.
- LinuxBender 8y ago
  SMS is actually clear text over SS7. I would not send anything I care about over it. It is also trivial to spoof. All you need is 1 SS7 link and you can be any phone, kick anyone off a cell site, override call congestion and bump people off, change the display on your phone to any text, too many things to name.
woolvalley 8y ago
I vaguely remember rumors (or maybe it was used in a few court cases by the FBI), where carriers would turn on the microphones of 2G dumb phones remotely and silently. So your dumb phone probably has the same issue. Carriers also keep records of where subscriber devices have been, so even if your phone doesn't have GPS, the carrier has cell tower triangulation logs of the device too. ISPs such as comcast also save your browsing history to run their advertising networks, so that is also recorded somewhere too. And if/when net neutrality goes away completely, they might just sell that info too: https://arstechnica.com/tech-policy/2017/03/comcast-we-wont-sell-browser-history-and-you-can-opt-out-of-targeted-ads/ https://arstechnica.com/tech-policy/2017/03/comcast-we-wont-... Whats even worse about ISPs doing it is how you usually have no other choices and it's your complete traffic stream!
michaelcampbell 8y ago
Steve Gibson did a wireshark investigation of an Alexa, it is NOT always transmitting. Your assertion that "nobody can prove that" is rather absurd.
- bootaccount 8y ago
  there's nothing stopping from Alexa recording content locally and transmitting it with a traditional request once activated. Also, there's no reason for Amazon to want a constant stream of Alexa data hitting their cloud services. The goal is to mine and extract valuable data about users to build profiles, ideally you'd want to do that on-device and send up the most valuable bits. These are also capabilities they can silently introduce at anytime for any device. Steve Gibsons "analysis" means nothing.
  - sushisource 8y ago
    Except, you know, memory - of which these devices don't have a ton.
    - tlb 8y ago
      You can store around 1000 hours of recorded speech in a gigabyte of flash memory that costs $0.25. For most people, that could hold their entire conversational activity for a year. Storage and off-line upload (perhaps during a software update when packets are flying around anyway) isn't difficult.
  - Analog24 8y ago
    They can not silently introduce new hardware to these devices. You should look into what kind of hardware these devices actually contain. Try to set up an intelligent, personalized data miner with those constraints.
- LinuxBender 8y ago
  Steve was not thinking this through. I can batch compress chunks of audio and lazy upload them when I think nobody is around. A listening device could probably even guess when you are not going to be using your internet connection.
falcolas 8y ago
Actually, quite the contrary has been proven to point 1: both for Alexa (the spooky laugh episode) and Google Play (the "always pressed" button episode). I almost think that the burden of proof that things aren't being sent is a valid expectation in this point. And that proof needs to be re-confirmed with each firmware update to ensure a bug hasn't caused the behavior to change.
- cblades 8y ago
  Those aren't examples of the contrary, those are examples of in-precise recognition. That's miles away from being the same thing as "always recording".

1) Nobody can prove that. It's always listening and you have to assume always recording and transmitting. 2) My phone is a $12 throw away that speaks voice and sms (text). 3) Loose lips sink ships.

ryanmercer 8y ago

> Nobody can prove that. It's always listening and you have to assume always recording and transmitting Uh... packet analyzers, IP logs, bandwidth monitoring tools etc... If instead of transmitting occasional bursts of data when you say the wake word it's been sending back tens of megabytes an hour, or tens to hundreds of megabytes a day, you can go "hey, it's probably transmitting everything it hears". There are people that religiously watch what these devices are sending back just to try and catch one of the companies doing something fishy. There are people that religiously watch their network traffic period looking for something nefarious. These devices aren't like your phone, where simply having it on can have all sorts of services/apps using data in the background or you open a webpage and tens or even hundreds of different servers are contacted and data pulled/pushed to/from them. It's a device that should be periodically checking for an update and sending very small audio files back in nearly-real time. If they were recording regularly, or especially all the time, and transmitting it back to a server it would stand out like a sore thumb. Never mind the fact that keeping it secret, and not having a whistle blower, would be damn impossible. Someone's going to mention it to a loved one or friend, or flat out go online "I discovered my Amazon/Google device is actively listening and recording and sending to these IPs in these intervals" when they just know it as fact and didn't have to 'discover' it.

LinuxBender 8y ago
Which nobody can do. It is encrypted and unless the device accept invalid certs, they can queue up, compress, batch upload any data they want. They control the security, not the end-luser.
- y04nn 8y ago
  Encrypted or not, an audio stream should not be difficult to identify.
  - LinuxBender 8y ago
    If they batch compress and upload, it wont be a stream. It could be aes-256 lzma2 compressed chunks. Using the right codec, they could likely upload a hour of audio in a few hundred kbytes. I have seen some demos of highly bw optimized codecs. Here are some staring points. [1] I would go with Opus. My voice chat server uses that. [1] - https://stackoverflow.com/questions/167533/best-voice-compression-algorithms-formats https://stackoverflow.com/questions/167533/best-voice-compre...
    - vinkelhake 8y ago
      > Using the right codec, they could likely upload a hour of audio in a few hundred kbytes. But at the same time, you're convinced that you would notice if your phone was slipping out these kilobytes as part of its usual communication? It seems to me that you've just arbitrarily picked a level of paranoia where you've decided that this can definitely happen with the Alexa, but won't happen with your phone. Your proud paranoia isn't applied consistently.
      - LinuxBender 8y ago
        I am not convinced of anything. The risk of the throw away device uploading my audio is significantly lower than a device powered in my home, with dedicated fast internet.
  - cc439 8y ago
    What if they convert speech to text like the American intel agencies do as proved by the Snowden and Vault 7 leaks?
    - ryanmercer 8y ago
jakeogh 8y ago
Can you MITM SSL the conversations to Amazon? It has memory. There is no requirement that it transmits in real time.

Klathmon 8y ago

If we are playing the "you can't prove that" game, then you also can't prove that your $12 throw away phone isn't always recording, or that you new kitchen countertop doesn't have a recording device embedded in it, or that the maker of whatever device you are using to type that comment isn't breaking a plethora of laws to record everything you type or say or do around that device at any time.

LinuxBender 8y ago
When my throw away phone is transmitting, it gets warm. I also set it next to an amplifier and I can actually hear it bleed into the amp when it chats with the cell site. I can even tell a couple of seconds ahead of time when I am getting a text or a phone call.
- recursive 8y ago
  > When my throw away phone is transmitting, it gets warm Maybe that's just what they want you to think so you don't dig any deeper.
- jedberg 8y ago
  Yeah, but you can also do the same with the Alexa device by watching it transmit data over the wire. If you think watching the transmissions is enough to prove your cell phone isn't recording, then it should be enough to prove the Alexa isn't recording. Or not be sufficient in both cases.
- Klathmon 8y ago
  And all a hypothetical "bug" needs to do is listen for some key phrases, and send a single byte or a few bytes of data across the wire, even through side channels. I can imagine a system that throws an extra byte or 2 on those "chats" with the cell tower, or even abuses the timing that it decides to reach out and check the tower as the method of communication. The actual voice recording and processing tech is small enough that it could be thrown right alongside the actual phone, for pretty cheap, and could run entirely separate from the phone itself, maybe even having its own battery!
8y ago

jedberg 8y ago

> Nobody can prove that. You guys are way to paranoid. They're a public company and they are constantly under audit. They have explicitly stated in their white papers that the device has two computers, one that just listens for the "Alexa" keyword that activates the other one for signal processing. Do you really think they would lie on those white papers? The government would be so far up their ass with fines it would be ridiculous. Not to mention people have actually done tear downs of the device and you can see the two computers and monitor the power input to each one as it runs. The "dumb" computer with minimal memory would be having to store hours of speech data until you say the keyword so it can transmit to the other computer.

LinuxBender 8y ago
Audits of controls are about ensuring the longevity of the business. They are entirely orthogonal to ethics or business models. And yes, I am proudly paranoid. History and experience have confirmed the need for my paranoia for many decades.
- jedberg 8y ago
  > Audits of controls are about ensuring the longevity of the business. You must not have suffered a SOX audit before. Part of the audit is technical. Also, the SEC greatly frowns upon lying about your business.
  - LinuxBender 8y ago
    I have suffered every kind of audit, many times. I know of many technical facets of every business I worked for that would never have been a part of any of those audits. Do you know of any published Amazon audits that describe in detail what specifically around Alexa is audited, if anything?
aero142 8y ago
Yes, but is that behavior changeable with only a software update?
8y ago

briandear 8y ago

And your SMS is logged as well as cell towers to which you connect. Is the “phone company” more secure than any other? If you really are someone in need of a tin foil hat, you should ditch the phone completely and communicate solely with dead drops and one-time pads.

jakeogh 8y ago
Fun to watch the venerable "tin foil hat" lose it's luster.
LinuxBender 8y ago
SMS is actually clear text over SS7. I would not send anything I care about over it. It is also trivial to spoof. All you need is 1 SS7 link and you can be any phone, kick anyone off a cell site, override call congestion and bump people off, change the display on your phone to any text, too many things to name.

woolvalley 8y ago

I vaguely remember rumors (or maybe it was used in a few court cases by the FBI), where carriers would turn on the microphones of 2G dumb phones remotely and silently. So your dumb phone probably has the same issue. Carriers also keep records of where subscriber devices have been, so even if your phone doesn't have GPS, the carrier has cell tower triangulation logs of the device too. ISPs such as comcast also save your browsing history to run their advertising networks, so that is also recorded somewhere too. And if/when net neutrality goes away completely, they might just sell that info too: https://arstechnica.com/tech-policy/2017/03/comcast-we-wont-sell-browser-history-and-you-can-opt-out-of-targeted-ads/ https://arstechnica.com/tech-policy/2017/03/comcast-we-wont-... Whats even worse about ISPs doing it is how you usually have no other choices and it's your complete traffic stream!

michaelcampbell 8y ago

Steve Gibson did a wireshark investigation of an Alexa, it is NOT always transmitting. Your assertion that "nobody can prove that" is rather absurd.

bootaccount 8y ago
there's nothing stopping from Alexa recording content locally and transmitting it with a traditional request once activated. Also, there's no reason for Amazon to want a constant stream of Alexa data hitting their cloud services. The goal is to mine and extract valuable data about users to build profiles, ideally you'd want to do that on-device and send up the most valuable bits. These are also capabilities they can silently introduce at anytime for any device. Steve Gibsons "analysis" means nothing.
- sushisource 8y ago
  Except, you know, memory - of which these devices don't have a ton.
  - tlb 8y ago
    You can store around 1000 hours of recorded speech in a gigabyte of flash memory that costs $0.25. For most people, that could hold their entire conversational activity for a year. Storage and off-line upload (perhaps during a software update when packets are flying around anyway) isn't difficult.
- Analog24 8y ago
  They can not silently introduce new hardware to these devices. You should look into what kind of hardware these devices actually contain. Try to set up an intelligent, personalized data miner with those constraints.
LinuxBender 8y ago
Steve was not thinking this through. I can batch compress chunks of audio and lazy upload them when I think nobody is around. A listening device could probably even guess when you are not going to be using your internet connection.

falcolas 8y ago

Actually, quite the contrary has been proven to point 1: both for Alexa (the spooky laugh episode) and Google Play (the "always pressed" button episode). I almost think that the burden of proof that things aren't being sent is a valid expectation in this point. And that proof needs to be re-confirmed with each firmware update to ensure a bug hasn't caused the behavior to change.

cblades 8y ago
Those aren't examples of the contrary, those are examples of in-precise recognition. That's miles away from being the same thing as "always recording".