8 ms·

Roku enabled TVs very clearly send back frames of what you are watching. I've been watching YouTube casted via chromecast plugged into HDMI (NOT the built in ch

Roku enabled TVs very clearly send back frames of what you are watching. I've been watching YouTube casted via chromecast plugged into HDMI (NOT the built in chromecast, I have verified multiple times) and the Roku will give me a full width toast saying to press `*` to watch the full movie or some similar contextual option I was pretty put off the first time this happened. That said, I don't even know if I looked through the settings to see if I could turn it off..

paggle 7y ago
It may be sending video or audio frames but it’s also possible without it. The Chromecast can send side channel data to the TV.
- bentpins 7y ago
  That or it could be sending only a fingerprint (still a privacy issue, but less severe)
- obmelvin 7y ago
  Huh...I feel stupid. I should've realized that HDMI can send additional data... or rather should've put 2 and 2 together
  - voidmain0001 7y ago
    I remember reading a comment some time ago which stated that they were concerned about the trustworthiness of HDMI, Thunderbolt, and the like as they can contain hidden features that could compromise the user. Fascinating. We need a firewall on our gateways, and on our peripheral ports.
phire 7y ago
It's probably using fingerprinting rather than uploading the whole frame. And I would guess it's only audio fingerprinting, rather than full video.
Silhouette 7y ago
Are you sure about this? If the TV really is phoning home with whatever is on the screen, including anything personal the owner might happen to be displaying, that's a vast set of lawsuits waiting to happen. The GDPR fines alone could be staggering. I could easily imagine spyware logging whatever TV shows you're streaming and the like, but it's hard to imagine any business in this industry having lawyers dumb enough to allow sending actual screen images like that.
- obmelvin 7y ago
  Sorry, I was being a bit lazy in my comment. I didn't specify, but I don't really suspect they are sending full frames back if for no other reason than bandwidth. But, honestly fingerprinting is so similar it might as well be the same thing. Though thankfully, yes, the fingerprint calculated for something personal probably is meaningless to them, but possibly could be replaced with a reversible option
  - btown 7y ago
    One danger is that videos can now "phone home" with the TV they're viewed on. You could torrent through Tor and take all sorts of precautions, then watch on your TV at home and leak your viewing habits. Or worse, get someone else targeted for copyright enforcement if you watch pirated content on their TV.
    - rocqua 7y ago
      How would data in the video be used to direct the TV to phone home? As in, what field would be set?
      - jodrellblank 7y ago
        I guess it would be a watermark style change through all the video frames which affects the hashes - e.g. brightness or contrast or sharpness or some combination of that kind of thing - then seed that on torrent sites, and advertisers get to see which TVs watched the torrented film vs the official film.
xcgfhgjbjhb 7y ago
I worked on that. It sends audio and/or video fingerprints (not frames, for privacy and bandwidth reasons), which are matched against a fingerprint database. Whatever people see on TV is usually 10 to 60 seconds behind the real live stream at the broadcaster (which is where the reference fingerprinting happens). GeoIP data can be used to roughly deduce where the TV is located, in order to better filter out false positives out of multiple matches (e.g. in the US where lots of programming on east/west side is just shifted by ~3 hours due to time difference).
- move-on-by 7y ago
  Any way to turn it off? Or perhaps block a specific domain via pihole?
  - sjwright 7y ago
    Don’t let your TV access the internet at all. Smart TV interfaces are almost uniformly worse than set top boxes (one or more of: bad UI, slow CPU, weird quirks, few updates) so you should avoid it anyway. The current Apple TV (which I cite only because of familiarity) has a great UI, every major app, and robust HDMI-CEC support so you might never have to touch your TV’s remote again. And Apple respects your privacy.
    - rodgerd 7y ago
      Some smart TVs will join open networks if you don't give them one. And I expect that if 5G works as advertised you'll see surveillance capitalism adding 5G connectivity so you no longer have control over connectivity.
      - rangibaby 7y ago
        > And I expect that if 5G works as advertised you'll see surveillance capitalism adding 5G connectivity so you no longer have control over connectivity. That's nothing a roll of tinfoil can't fix
israrkhan 7y ago
It is off by default and is enabled only if you opt in. They call it "More ways to watch". If you have enabled it, you can disable it later on from the settings.
sbarre 7y ago
This is a good reason for a pi-hole type of ad blocker on your network. When I noticed my Roku TV was sending something to some remote analytics or tracking server every 30 seconds whenever it was turned on, I just blocked everything coming from it. Eventually though I factory-reset it and didn't bother connecting it to the network at all. All the on-TV apps are junk and I'd rather just use an Apple TV (which sends it's own analytics, I know).
unwiredben 7y ago
The setting is controlled by "Settings/Privacy/Smart TV Experience". The first time you go into an input a dialog shows up asking the user to opt-in or out of this.
non-entity 7y ago
I'm really curious about this now, I wonder if there is some sort of way to sniff the the data / packets / whatever being sent and try to decode it

paggle 7y ago

It may be sending video or audio frames but it’s also possible without it. The Chromecast can send side channel data to the TV.

bentpins 7y ago
That or it could be sending only a fingerprint (still a privacy issue, but less severe)
obmelvin 7y ago
Huh...I feel stupid. I should've realized that HDMI can send additional data... or rather should've put 2 and 2 together
- voidmain0001 7y ago
  I remember reading a comment some time ago which stated that they were concerned about the trustworthiness of HDMI, Thunderbolt, and the like as they can contain hidden features that could compromise the user. Fascinating. We need a firewall on our gateways, and on our peripheral ports.

phire 7y ago

It's probably using fingerprinting rather than uploading the whole frame. And I would guess it's only audio fingerprinting, rather than full video.

Silhouette 7y ago

Are you sure about this? If the TV really is phoning home with whatever is on the screen, including anything personal the owner might happen to be displaying, that's a vast set of lawsuits waiting to happen. The GDPR fines alone could be staggering. I could easily imagine spyware logging whatever TV shows you're streaming and the like, but it's hard to imagine any business in this industry having lawyers dumb enough to allow sending actual screen images like that.

obmelvin 7y ago
Sorry, I was being a bit lazy in my comment. I didn't specify, but I don't really suspect they are sending full frames back if for no other reason than bandwidth. But, honestly fingerprinting is so similar it might as well be the same thing. Though thankfully, yes, the fingerprint calculated for something personal probably is meaningless to them, but possibly could be replaced with a reversible option
- btown 7y ago
  One danger is that videos can now "phone home" with the TV they're viewed on. You could torrent through Tor and take all sorts of precautions, then watch on your TV at home and leak your viewing habits. Or worse, get someone else targeted for copyright enforcement if you watch pirated content on their TV.
  - rocqua 7y ago
    How would data in the video be used to direct the TV to phone home? As in, what field would be set?
    - jodrellblank 7y ago
      I guess it would be a watermark style change through all the video frames which affects the hashes - e.g. brightness or contrast or sharpness or some combination of that kind of thing - then seed that on torrent sites, and advertisers get to see which TVs watched the torrented film vs the official film.

xcgfhgjbjhb 7y ago

I worked on that. It sends audio and/or video fingerprints (not frames, for privacy and bandwidth reasons), which are matched against a fingerprint database. Whatever people see on TV is usually 10 to 60 seconds behind the real live stream at the broadcaster (which is where the reference fingerprinting happens). GeoIP data can be used to roughly deduce where the TV is located, in order to better filter out false positives out of multiple matches (e.g. in the US where lots of programming on east/west side is just shifted by ~3 hours due to time difference).

move-on-by 7y ago
Any way to turn it off? Or perhaps block a specific domain via pihole?
- sjwright 7y ago
  Don’t let your TV access the internet at all. Smart TV interfaces are almost uniformly worse than set top boxes (one or more of: bad UI, slow CPU, weird quirks, few updates) so you should avoid it anyway. The current Apple TV (which I cite only because of familiarity) has a great UI, every major app, and robust HDMI-CEC support so you might never have to touch your TV’s remote again. And Apple respects your privacy.
  - rodgerd 7y ago
    Some smart TVs will join open networks if you don't give them one. And I expect that if 5G works as advertised you'll see surveillance capitalism adding 5G connectivity so you no longer have control over connectivity.
    - rangibaby 7y ago
      > And I expect that if 5G works as advertised you'll see surveillance capitalism adding 5G connectivity so you no longer have control over connectivity. That's nothing a roll of tinfoil can't fix

israrkhan 7y ago

It is off by default and is enabled only if you opt in. They call it "More ways to watch". If you have enabled it, you can disable it later on from the settings.

sbarre 7y ago

This is a good reason for a pi-hole type of ad blocker on your network. When I noticed my Roku TV was sending something to some remote analytics or tracking server every 30 seconds whenever it was turned on, I just blocked everything coming from it. Eventually though I factory-reset it and didn't bother connecting it to the network at all. All the on-TV apps are junk and I'd rather just use an Apple TV (which sends it's own analytics, I know).

unwiredben 7y ago

The setting is controlled by "Settings/Privacy/Smart TV Experience". The first time you go into an input a dialog shows up asking the user to opt-in or out of this.

non-entity 7y ago

I'm really curious about this now, I wonder if there is some sort of way to sniff the the data / packets / whatever being sent and try to decode it