5 ms·

I work for a company where we have contractors at the customer service centers. This is pretty standard for customer service workers. They handle reservations o

I work for a company where we have contractors at the customer service centers. This is pretty standard for customer service workers. They handle reservations over the phone and customer support. The centers where they work are very locked down. They deal with customer names and credit cards as part of their jobs. They go through background checks. (It can be hard to get enough people who both apply and can pass the checks ) They cannot bring in phones, memory sticks, pens, or paper. they have to pass through a scanner to enter and leave the floor. They work on stations with locked down ports and restricted internet access. I went there for a meeting but was not allowed on the floor because it was not pre-approved by security. If the Apple centers where Siri errors are reviewed is like that, it would be hard to sneak recordings out.

braythwayt 7y ago
I have worked in similar locked-down environments. Phones, cameras, USB keys, and so on were all checked into lockers before entering the secure area, and this was despite the fact that the computers had all their ports physically glued shut, and there were digital locks and snooping going on as well. At some level, you have to accept that things like Siri operate just like talking to human customer service representatives, who these days always begin conversations with a rote "This call may be recorded for quality and customer service purposes." What it comes down to is whether you trust the company to be unreasonably diligent in controlling what happens to these recordings. If there is a criticism to be levelled here, I think it is around the question of how well Apple and everyone else in this space allow consumers to make informed choices. Fine print in a voluminous user agreement is not nearly the same standard of disclosure as "Your words may be recorded for quality and customer service purposes" every time you say "Hey Siri." The latter may be impractical, of course, but perhaps there is a middle ground. It's not a dichotomy.
- hnuser123456 7y ago
  User: "Hey Siri" Siri: "We're listening"
- kitchenkarma 7y ago
  It's a bit naive thinking that employees would store their electronics in the lockers. Even if you have spot searches (including cavity search) it still doesn't exclude rogue employee just "forgetting" to store his or hers camera in the locker.
  - braythwayt 7y ago
    Nobody in that business was naïve. Employees did not "forget," if they were caught with their phone in the secure area, they were fired. I was told right up front that certain things were zero tolerance, and everybody knew what they were. They took this very seriously. Now when it comes to a deliberately bad actor, well, nothing is 100% perfect, but there were many other security things going on that I am not going to describe here, plus I know for a fact that there were security measures they did not disclose to me. But let's face it: Somebody, somewhere, can train themselves to memorize a screen full of information. They could memorize something, go for a smoke break, and upload what they memorized. Lather, rinse, repeat. The point I made, and am still making, is that some companies care enough to do everything reasonably possible to keep customer data secure, while other companies do not. The company I described here cares. I believe Apple cares too. I suspect it will always be possible for someone to pull a small data heist, but extraordinarily difficult to set up a regular pipeline to exfiltrate data. The weak point is probably the digital systems. Most attackers would want everything, and the way to get everything is with a vulnerability.
- tripzilch 7y ago
  > you have to accept that things like Siri operate just like talking to human customer service representatives, who these days always begin conversations with a rote "This call may be recorded for quality and customer service purposes." Then why isn't it mandatory for Siri to start every conversation like that too?
nitwit005 7y ago
While I'm sure they try their best, if you search online for "leaked security footage", you will quickly find things from prisons, embassies, and other locations that are obviously supposed to be high security. We live in an age where everyone wanders around with a device for broadcasting video to the world in their pocket.
brianpgordon 7y ago
All of that sounds impressive, until you see red team pros talk about how the whole apparatus melts before the gentlest of social engineering- https://www.youtube.com/watch?v=JsVtHqICeKE https://www.youtube.com/watch?v=JsVtHqICeKE I'd also be concerned with leaking of mass amounts of records at once due to a security lapse on servers where it's a bit easier for grossly inadequate protections to lurk unnoticed- https://news.ycombinator.com/item?id=19191241 https://news.ycombinator.com/item?id=19191241 I think I've read that Google doesn't even store the original recordings, but distorts them randomly to make them unrecognizable but still intelligible by their models. That seems like a pretty reasonable way to protect people, provided they're informed and there's no link back to the original account.
- dannyw 7y ago
  That cannot be the case when you can listen to a crystal clear record of every voice assistant clip you’ve made, in My Activity.
  - brianpgordon 7y ago
    Wow, thanks for pointing that out. I didn't know that was a thing. It's not even encrypted with a device key or something on my phone - I can listen to a recording my own voice streaming straight from myactivity.google.com to my desktop web browser. I guess the voice scrambling thing must have been specific to their human-supervised learning program. I expect the unaltered voice data is treated with some special care on Google's backend... but I'm still creeped out.
kitchenkarma 7y ago
Do they go through phased entry system. For example phase 1 metal detector arch and a 3d scanner like in the airport. Phase 2 strip naked for body and cavity search and then phase 3 - wear company uniform with attached camera and microphones? If not then I can't see how they couldn't take a pendrive in.

braythwayt 7y ago

I have worked in similar locked-down environments. Phones, cameras, USB keys, and so on were all checked into lockers before entering the secure area, and this was despite the fact that the computers had all their ports physically glued shut, and there were digital locks and snooping going on as well. At some level, you have to accept that things like Siri operate just like talking to human customer service representatives, who these days always begin conversations with a rote "This call may be recorded for quality and customer service purposes." What it comes down to is whether you trust the company to be unreasonably diligent in controlling what happens to these recordings. If there is a criticism to be levelled here, I think it is around the question of how well Apple and everyone else in this space allow consumers to make informed choices. Fine print in a voluminous user agreement is not nearly the same standard of disclosure as "Your words may be recorded for quality and customer service purposes" every time you say "Hey Siri." The latter may be impractical, of course, but perhaps there is a middle ground. It's not a dichotomy.

hnuser123456 7y ago
User: "Hey Siri" Siri: "We're listening"
kitchenkarma 7y ago
It's a bit naive thinking that employees would store their electronics in the lockers. Even if you have spot searches (including cavity search) it still doesn't exclude rogue employee just "forgetting" to store his or hers camera in the locker.
- braythwayt 7y ago
  Nobody in that business was naïve. Employees did not "forget," if they were caught with their phone in the secure area, they were fired. I was told right up front that certain things were zero tolerance, and everybody knew what they were. They took this very seriously. Now when it comes to a deliberately bad actor, well, nothing is 100% perfect, but there were many other security things going on that I am not going to describe here, plus I know for a fact that there were security measures they did not disclose to me. But let's face it: Somebody, somewhere, can train themselves to memorize a screen full of information. They could memorize something, go for a smoke break, and upload what they memorized. Lather, rinse, repeat. The point I made, and am still making, is that some companies care enough to do everything reasonably possible to keep customer data secure, while other companies do not. The company I described here cares. I believe Apple cares too. I suspect it will always be possible for someone to pull a small data heist, but extraordinarily difficult to set up a regular pipeline to exfiltrate data. The weak point is probably the digital systems. Most attackers would want everything, and the way to get everything is with a vulnerability.
tripzilch 7y ago
> you have to accept that things like Siri operate just like talking to human customer service representatives, who these days always begin conversations with a rote "This call may be recorded for quality and customer service purposes." Then why isn't it mandatory for Siri to start every conversation like that too?

nitwit005 7y ago

While I'm sure they try their best, if you search online for "leaked security footage", you will quickly find things from prisons, embassies, and other locations that are obviously supposed to be high security. We live in an age where everyone wanders around with a device for broadcasting video to the world in their pocket.

brianpgordon 7y ago

All of that sounds impressive, until you see red team pros talk about how the whole apparatus melts before the gentlest of social engineering- https://www.youtube.com/watch?v=JsVtHqICeKE https://www.youtube.com/watch?v=JsVtHqICeKE I'd also be concerned with leaking of mass amounts of records at once due to a security lapse on servers where it's a bit easier for grossly inadequate protections to lurk unnoticed- https://news.ycombinator.com/item?id=19191241 https://news.ycombinator.com/item?id=19191241 I think I've read that Google doesn't even store the original recordings, but distorts them randomly to make them unrecognizable but still intelligible by their models. That seems like a pretty reasonable way to protect people, provided they're informed and there's no link back to the original account.

dannyw 7y ago
That cannot be the case when you can listen to a crystal clear record of every voice assistant clip you’ve made, in My Activity.
- brianpgordon 7y ago
  Wow, thanks for pointing that out. I didn't know that was a thing. It's not even encrypted with a device key or something on my phone - I can listen to a recording my own voice streaming straight from myactivity.google.com to my desktop web browser. I guess the voice scrambling thing must have been specific to their human-supervised learning program. I expect the unaltered voice data is treated with some special care on Google's backend... but I'm still creeped out.

kitchenkarma 7y ago

Do they go through phased entry system. For example phase 1 metal detector arch and a 3d scanner like in the airport. Phase 2 strip naked for body and cavity search and then phase 3 - wear company uniform with attached camera and microphones? If not then I can't see how they couldn't take a pendrive in.