4 ms·

For Google, I'm not sure how option 2 is supposed to be acceptable either. It is perfectly reasonable to be concerned about introducing an internet-connected mi

For Google, I'm not sure how option 2 is supposed to be acceptable either. It is perfectly reasonable to be concerned about introducing an internet-connected microphone into your house. It doesn't even require assuming a malicious Google to see potential problems with this. You're one decent security flaw (in an IoT device no less) from anybody having a microphone in your house.

est31 8y ago
> You're one decent security flaw (in an IoT device no less) from anybody having a microphone in your house. Many people already have Android smartphones, so there is already a Google microphone in your house. The big difference is that you know that it has a microphone.
- skookumchuck 8y ago
  The smartphone requires a battery, which drains away noticeably if it is sending all your conversations. The Nest is connected to the house power, so it can stream audio non-stop.
  - bpye 8y ago
    Additionally a user is likely to pay a lot more attention to their phone than to their Nest devices. A compromised Nest device will likely stay compromised until Google find the exploit...
  - jannes 8y ago
    Are you sure about that battery drain? A malicious actor could easily conceal their activity by making 24-hour-long recordings and sending them in the night (or whenever connected to WiFi and plugged into power).
    - cesarb 8y ago
      The main trick smartphones use to have their battery last long enough, is to power off every piece of hardware that's not in use, for as long as possible. Doing a 24-hour-long recording would require the main CPU to be awake far more often than usual (and in fact, I would suspect it would have to be pretty much constantly awake, unless the phone had a large dedicated hardware buffer for the recorded audio samples).
- baxtr 8y ago
  Which of course makes a big difference. We are all adults. We can weight pros and cons and then make an informed decision. Not so if we don’t know all the details. This is what you’re betting on when leaving “details” like this out.
  - smolder 8y ago
    Lots of technology now incorporates the idea that people are better not given too many choices. DRM/trusted computing, root-locked phones, software and operating systems that decide what information they send where, without any explicit consent or choice to disable.
    - NeutronStar 8y ago
      And how is any of that fine?
- sam_goody 8y ago
  And many people don't have Android phones, so this could be pretty significant. Besides, the attack vector for a non-Google attacker to access this mic may be different than for accessing the mic on a phone
- jusssi 8y ago
  Not to mention, that Android phones seem to pick up "ok google" activation pattern from random conversations, and start sending voice to Google's servers for speech-to-text processing. Even after repeated attempts to find and turn off voice activation from settings.
- dnbgfher 8y ago
  While true, the upgrade situation for Android is way better than for most IoT devices, which is saying something. And this is the sort of thing you may well keep for a decade. While you may still have other Google microphones, I would be a lot more worried about this one specifically being vulnerable at some point.
sl1ck731 8y ago
I don't know which specs exactly people are referencing, but if its marketing specs or the specs you would see on the box then I don't expect consumer products to have "microphone (disabled)" for unused hardware just as I wouldn't expect it to list some unused PCB circuitry. It might be reasonable to be concerned about this kind of thing in the tech crowd, but the vast majority of people aren't.
- TeMPOraL 8y ago
  > I don't expect consumer products to have "microphone (disabled)" for unused hardware This should absolutely be the expectation. A note of "microphone (disabled in software)" at minimum. Since when is it OK for a company to sell you a product with hidden functionality that can be used to harm you by either the manufacturer or third parties? (The obvious defense is that they're not selling it to you, they're renting it out. Such is the pathology of turning products into services. It's a sick market dynamic.)
  - sl1ck731 8y ago
    How many things built into products have obsolete hardware or unused functionality that would have to be listed? I understand being reactionary to a microphone but where is the line? How do you draw it? Do I need to list all the capabilities of some SoC even if I don't take any advantage of them? If a component has thermal sensors I'm not using do I have to list every one of them on the box?
- criddell 8y ago
  The tech crowd are their first customers. There's no downside to listing the microphone, so why not do it?
pbhjpbhj 8y ago
I'm sure (this is not sarcasm) that the people behind the leak of recordings of confidential doctor-patient phone calls had no malicious intent. So, I agree no malicious intent is needed to make things turn very bad.

est31 8y ago

> You're one decent security flaw (in an IoT device no less) from anybody having a microphone in your house. Many people already have Android smartphones, so there is already a Google microphone in your house. The big difference is that you know that it has a microphone.

skookumchuck 8y ago
The smartphone requires a battery, which drains away noticeably if it is sending all your conversations. The Nest is connected to the house power, so it can stream audio non-stop.
- bpye 8y ago
  Additionally a user is likely to pay a lot more attention to their phone than to their Nest devices. A compromised Nest device will likely stay compromised until Google find the exploit...
- jannes 8y ago
  Are you sure about that battery drain? A malicious actor could easily conceal their activity by making 24-hour-long recordings and sending them in the night (or whenever connected to WiFi and plugged into power).
  - cesarb 8y ago
    The main trick smartphones use to have their battery last long enough, is to power off every piece of hardware that's not in use, for as long as possible. Doing a 24-hour-long recording would require the main CPU to be awake far more often than usual (and in fact, I would suspect it would have to be pretty much constantly awake, unless the phone had a large dedicated hardware buffer for the recorded audio samples).
baxtr 8y ago
Which of course makes a big difference. We are all adults. We can weight pros and cons and then make an informed decision. Not so if we don’t know all the details. This is what you’re betting on when leaving “details” like this out.
- smolder 8y ago
  Lots of technology now incorporates the idea that people are better not given too many choices. DRM/trusted computing, root-locked phones, software and operating systems that decide what information they send where, without any explicit consent or choice to disable.
  - NeutronStar 8y ago
    And how is any of that fine?
sam_goody 8y ago
And many people don't have Android phones, so this could be pretty significant. Besides, the attack vector for a non-Google attacker to access this mic may be different than for accessing the mic on a phone
jusssi 8y ago
Not to mention, that Android phones seem to pick up "ok google" activation pattern from random conversations, and start sending voice to Google's servers for speech-to-text processing. Even after repeated attempts to find and turn off voice activation from settings.
dnbgfher 8y ago
While true, the upgrade situation for Android is way better than for most IoT devices, which is saying something. And this is the sort of thing you may well keep for a decade. While you may still have other Google microphones, I would be a lot more worried about this one specifically being vulnerable at some point.

sl1ck731 8y ago

I don't know which specs exactly people are referencing, but if its marketing specs or the specs you would see on the box then I don't expect consumer products to have "microphone (disabled)" for unused hardware just as I wouldn't expect it to list some unused PCB circuitry. It might be reasonable to be concerned about this kind of thing in the tech crowd, but the vast majority of people aren't.

TeMPOraL 8y ago
> I don't expect consumer products to have "microphone (disabled)" for unused hardware This should absolutely be the expectation. A note of "microphone (disabled in software)" at minimum. Since when is it OK for a company to sell you a product with hidden functionality that can be used to harm you by either the manufacturer or third parties? (The obvious defense is that they're not selling it to you, they're renting it out. Such is the pathology of turning products into services. It's a sick market dynamic.)
- sl1ck731 8y ago
  How many things built into products have obsolete hardware or unused functionality that would have to be listed? I understand being reactionary to a microphone but where is the line? How do you draw it? Do I need to list all the capabilities of some SoC even if I don't take any advantage of them? If a component has thermal sensors I'm not using do I have to list every one of them on the box?
criddell 8y ago
The tech crowd are their first customers. There's no downside to listing the microphone, so why not do it?

pbhjpbhj 8y ago

I'm sure (this is not sarcasm) that the people behind the leak of recordings of confidential doctor-patient phone calls had no malicious intent. So, I agree no malicious intent is needed to make things turn very bad.