5 ms·

Wonderful, now my data can be harvested wherever I go instead of just in the privacy of my own home

by okmokmz 7y ago

bdcravens 7y ago
You don't have a smartphone?
- squeaky-clean 7y ago
  > You don't have a smartphone? Not one developed by Amazon. It's not fair at all to say a microphone in an iPhone is equivalent to a microphone in an Amazon device.
  - OrgNet 7y ago
    Apple keeps recordings for 2 years, how long does Amazon keep theirs?
    - squeaky-clean 7y ago
      I agree with you on the point you're getting at. Really anything that can be potentially logged due to a bug or accessed by a human may as well be considered the same as perpetual, in my opinion. The difference is I trust Apple enough to turn off Siri on my phone and feel safe nothing is being broadcast online or stored locally for another app to access. Is this guaranteed? Hell no. I also don't read the source code of every open source program I use (and even if I do I'm aware people exist much smarter than me who can obfuscate their malicious code). Apple's business strategy, their history of actions, and their security system make me feel confident enough in _assuming_ my voice never reaches their servers and cannot be turned in by an app without explicit permissions. That last bit is also important. Like the Android Facebook background audio "bug", even if it is really a bug, to me it's no different. Lastly even if Amazon were trustworthy about not listening when they say and not accessing voice data they shouldn't, I don't trust the platform very much. Quick idea, can you create a multi-turn alexa skill that after the first turn pretends Alexa is finished but it is actually actively recording and waiting to fake a response to "Alexa! <do other skill>"? Personally I don't know, don't have the source to check, and I wouldn't really believe any amazon engineer coming in here and saying "It's impossible to exploit". (Even if my 5 minute idea is impossible multiply that times thousands of malicious people spending much longer trying to exploit it) edit: Don't mean to imply an Apple is impossible to hack or exploit. Just that they take a more active stance and have the history to back it up.
      - OrgNet 7y ago
        > edit: Don't mean to imply an Apple is impossible to hack or exploit. Just that they take a more active stance and have the history to back it up. the NSA don't need to hack them... they can just ask (they did). what we need is true e2e encryption ...
- okmokmz 7y ago
  Nice whataboutism edit: I guess the HN hive mind disagrees with my point. Just FYI if someone says they care about their privacy and don't want to use a product because of privacy concerns, and your counter argument is that they use some other product that has privacy concerns, that is a textbook example of a whataboutism
  - bdcravens 7y ago
    A phone has more surveillance capabilities than anything announced today.
    - okmokmz 7y ago
      Ok... I don't remember bringing up smart phones Here's some reading: https://www.merriam-webster.com/words-at-play/whataboutism-origin-meaning https://www.merriam-webster.com/words-at-play/whataboutism-o... When your entire argument is based on a very basic, widely used logical fallacy no one is going to take it seriously. I understand the point you're trying to make, but that isn't what's being discussed
      - bdcravens 7y ago
        > When your entire argument is based on a very basic, widely used logical fallacy no one is going to take it seriously. Like assuming a product has always-on data mining?
        okmokmz 7y ago
        No, not at all. That's a straw man argument. I never said that the product has always-on data mining and you're attempting to use that to invalidate my initial comment. If you have any genuine, logical arguments let me know but you're just attacking a viewpoint you seem to disagree with using blatant fallacious questions and statements
        bdcravens 7y ago
- mirimir 7y ago
  I don't have a smartphone. Edit: I had a Qualcomm pdQ in 1999.[0] But once I saw how smartphones were being designed as surveillance devices, I refused to play. 0) http://archives.cnn.com/1999/TECH/ptech/12/03/qualcomm.pdq/index.html http://archives.cnn.com/1999/TECH/ptech/12/03/qualcomm.pdq/i...
  - the_pwner224 7y ago
    > But once I saw how smartphones were being designed as surveillance devices, I refused to play. Get a FOSS Android phone. I have a OnePlus 7 Pro, previously a Galaxy S5 (the newer Galaxys also work as long as you don't get the US model); it runs LineageOS (stock Android). I chose not to install the Google Play packages. I get apps from F-Droid, which is a repository + package manager that builds and distributes FOSS applications. It pings time.android.com for NTP, and I think it also uses a Google server to check when you're behind a captive portal WiFi. The default dialer/SMS/Contacts app have some options in the settings that will connect to proprietary APIs; I don't think they talk to Google but if you do then you can replace them with applications from F-Droid. But other than that it's 100% clean. In the system settings I can completely block applications from using the network. LineageOS also adds Privacy Guard, which lets you deny permissions to applications. I need WhatsApp to communicate with some people, but I have denied it contact permissions so it gets fed an empty address book. I also have it set to require confirmation from me to use the camera or microphone. I also installed AdAway from F-Droid, which is a DNS-based firewall like Pi-Hole. From F-Droid I also got Firefox with uBlock Origin, K-9 mail client, NewPipe as a YouTube frontent, OsmAnd+ for maps/navigation, DavDroid to sync contacts & calendar with Nextcloud, the Nextcloud Notes app for synced notes, and a OpenVPN client to prevent AT&T from spying on me and injecting tracking identifiers into my internet usage. The only real threats in the system are the proprietary driver blobs and the risk of Google putting evil code into AOSP instead of limiting it to their proprietary services - but I hope the LineageOS team would be able to catch that.
- simias 7y ago
  I deactivated all voice controls on mine. The entire point of these frames is voice control.
johnpowell 7y ago
And a bonus. Now you can harvest my data too when I am behind you in the line at Starbucks.
- okmokmz 7y ago
  Perfect! Make sure you speak up so the AI can understand you and Amazon doesn't have to hire more poorly treated minimum wage employees to listen and figure out what you're saying
  - jgtrosh 7y ago
    There's good software to extract voice from audio though! One time I had this webpage [0] open, forgot about it, until a colleague started a phone conversation from the other side of the open space, my laptop's mic picked it up and I got his sharp voice in my headphones. [0]: https://people.xiph.org/~jm/demo/rnnoise/ https://people.xiph.org/~jm/demo/rnnoise/
  - autoexec 7y ago
    Amazon doesn't use minimum wage employees for that, they use "contractors" and if they get them overseas they don't even have to pay them minimum wage!
autoexec 7y ago
Yeah but do amazon build a backdoor for police into your glasses like they did for amazon ring?
- cthalupa 7y ago
  >backdoor for police into your glasses like they did for amazon ring? Citation needed, please. To the best of my knowledge there is no back door for police in ring gear. They can request video from users, but there is no requirement it be given up and the request can be denied.
  - autoexec 7y ago
    > They can request video from users, but there is no requirement it be given up and the request can be denied. If you refuse they have a deal with amazon to hand it over to them anyway. "However, he noted, there is a workaround if a resident happens to reject a police request. If the community member doesn’t want to supply a Ring video that seems vital to a local law enforcement investigation, police can contact Amazon, which will then essentially “subpoena” the video. “If we ask within 60 days of the recording and as long as it’s been uploaded to the cloud, then Ring can take it out of the cloud and send it to us legally so that we can use it as part of our investigation,” he said." source: https://www.govtech.com/security/Amazons-Ring-Video-Camera-Alarms-Privacy-Advocates.html https://www.govtech.com/security/Amazons-Ring-Video-Camera-A... Amazon can pretty much do whatever they want with your video feed including publish views from your doorstep on social media without your permission: https://www.buzzfeednews.com/article/daveyalba/amazon-ring-doorbell-company-using-security-footage-for-ads https://www.buzzfeednews.com/article/daveyalba/amazon-ring-d... Police have also shown up at people's doors to intimidate them into handing over videos. "Police have also told CNET in the past that they've shown up at known Ring users' doorsteps to request footage in person if the online requests don't pan out." source: https://www.cnet.com/news/amazon-ring-wants-police-to-keep-these-surveillance-details-from-you/ https://www.cnet.com/news/amazon-ring-wants-police-to-keep-t... This shouldn't surprise you though. Basically any scrap of data you give to companies like apple google and amazon will be sucked up by the government at some level. Just the other day there was an article about how companies are hit with national security letters forbidding them from saying anything about the data collection going on, but we've known since Snowden's leaks that the NSA was collecting data from those companies already.

Wonderful, now my data can be harvested wherever I go instead of just in the privacy of my own home

bdcravens 7y ago

You don't have a smartphone?

squeaky-clean 7y ago
> You don't have a smartphone? Not one developed by Amazon. It's not fair at all to say a microphone in an iPhone is equivalent to a microphone in an Amazon device.
- OrgNet 7y ago
  Apple keeps recordings for 2 years, how long does Amazon keep theirs?
  - squeaky-clean 7y ago
    I agree with you on the point you're getting at. Really anything that can be potentially logged due to a bug or accessed by a human may as well be considered the same as perpetual, in my opinion. The difference is I trust Apple enough to turn off Siri on my phone and feel safe nothing is being broadcast online or stored locally for another app to access. Is this guaranteed? Hell no. I also don't read the source code of every open source program I use (and even if I do I'm aware people exist much smarter than me who can obfuscate their malicious code). Apple's business strategy, their history of actions, and their security system make me feel confident enough in _assuming_ my voice never reaches their servers and cannot be turned in by an app without explicit permissions. That last bit is also important. Like the Android Facebook background audio "bug", even if it is really a bug, to me it's no different. Lastly even if Amazon were trustworthy about not listening when they say and not accessing voice data they shouldn't, I don't trust the platform very much. Quick idea, can you create a multi-turn alexa skill that after the first turn pretends Alexa is finished but it is actually actively recording and waiting to fake a response to "Alexa! <do other skill>"? Personally I don't know, don't have the source to check, and I wouldn't really believe any amazon engineer coming in here and saying "It's impossible to exploit". (Even if my 5 minute idea is impossible multiply that times thousands of malicious people spending much longer trying to exploit it) edit: Don't mean to imply an Apple is impossible to hack or exploit. Just that they take a more active stance and have the history to back it up.
    - OrgNet 7y ago
      > edit: Don't mean to imply an Apple is impossible to hack or exploit. Just that they take a more active stance and have the history to back it up. the NSA don't need to hack them... they can just ask (they did). what we need is true e2e encryption ...
okmokmz 7y ago
Nice whataboutism edit: I guess the HN hive mind disagrees with my point. Just FYI if someone says they care about their privacy and don't want to use a product because of privacy concerns, and your counter argument is that they use some other product that has privacy concerns, that is a textbook example of a whataboutism
- bdcravens 7y ago
  A phone has more surveillance capabilities than anything announced today.
  - okmokmz 7y ago
    Ok... I don't remember bringing up smart phones Here's some reading: https://www.merriam-webster.com/words-at-play/whataboutism-origin-meaning https://www.merriam-webster.com/words-at-play/whataboutism-o... When your entire argument is based on a very basic, widely used logical fallacy no one is going to take it seriously. I understand the point you're trying to make, but that isn't what's being discussed
    - bdcravens 7y ago
      > When your entire argument is based on a very basic, widely used logical fallacy no one is going to take it seriously. Like assuming a product has always-on data mining?
      - okmokmz 7y ago
        No, not at all. That's a straw man argument. I never said that the product has always-on data mining and you're attempting to use that to invalidate my initial comment. If you have any genuine, logical arguments let me know but you're just attacking a viewpoint you seem to disagree with using blatant fallacious questions and statements
        bdcravens 7y ago
mirimir 7y ago
I don't have a smartphone. Edit: I had a Qualcomm pdQ in 1999.[0] But once I saw how smartphones were being designed as surveillance devices, I refused to play. 0) http://archives.cnn.com/1999/TECH/ptech/12/03/qualcomm.pdq/index.html http://archives.cnn.com/1999/TECH/ptech/12/03/qualcomm.pdq/i...
- the_pwner224 7y ago
  > But once I saw how smartphones were being designed as surveillance devices, I refused to play. Get a FOSS Android phone. I have a OnePlus 7 Pro, previously a Galaxy S5 (the newer Galaxys also work as long as you don't get the US model); it runs LineageOS (stock Android). I chose not to install the Google Play packages. I get apps from F-Droid, which is a repository + package manager that builds and distributes FOSS applications. It pings time.android.com for NTP, and I think it also uses a Google server to check when you're behind a captive portal WiFi. The default dialer/SMS/Contacts app have some options in the settings that will connect to proprietary APIs; I don't think they talk to Google but if you do then you can replace them with applications from F-Droid. But other than that it's 100% clean. In the system settings I can completely block applications from using the network. LineageOS also adds Privacy Guard, which lets you deny permissions to applications. I need WhatsApp to communicate with some people, but I have denied it contact permissions so it gets fed an empty address book. I also have it set to require confirmation from me to use the camera or microphone. I also installed AdAway from F-Droid, which is a DNS-based firewall like Pi-Hole. From F-Droid I also got Firefox with uBlock Origin, K-9 mail client, NewPipe as a YouTube frontent, OsmAnd+ for maps/navigation, DavDroid to sync contacts & calendar with Nextcloud, the Nextcloud Notes app for synced notes, and a OpenVPN client to prevent AT&T from spying on me and injecting tracking identifiers into my internet usage. The only real threats in the system are the proprietary driver blobs and the risk of Google putting evil code into AOSP instead of limiting it to their proprietary services - but I hope the LineageOS team would be able to catch that.
simias 7y ago
I deactivated all voice controls on mine. The entire point of these frames is voice control.

johnpowell 7y ago

And a bonus. Now you can harvest my data too when I am behind you in the line at Starbucks.

okmokmz 7y ago
Perfect! Make sure you speak up so the AI can understand you and Amazon doesn't have to hire more poorly treated minimum wage employees to listen and figure out what you're saying
- jgtrosh 7y ago
  There's good software to extract voice from audio though! One time I had this webpage [0] open, forgot about it, until a colleague started a phone conversation from the other side of the open space, my laptop's mic picked it up and I got his sharp voice in my headphones. [0]: https://people.xiph.org/~jm/demo/rnnoise/ https://people.xiph.org/~jm/demo/rnnoise/
- autoexec 7y ago
  Amazon doesn't use minimum wage employees for that, they use "contractors" and if they get them overseas they don't even have to pay them minimum wage!

autoexec 7y ago

Yeah but do amazon build a backdoor for police into your glasses like they did for amazon ring?

cthalupa 7y ago
>backdoor for police into your glasses like they did for amazon ring? Citation needed, please. To the best of my knowledge there is no back door for police in ring gear. They can request video from users, but there is no requirement it be given up and the request can be denied.
- autoexec 7y ago
  > They can request video from users, but there is no requirement it be given up and the request can be denied. If you refuse they have a deal with amazon to hand it over to them anyway. "However, he noted, there is a workaround if a resident happens to reject a police request. If the community member doesn’t want to supply a Ring video that seems vital to a local law enforcement investigation, police can contact Amazon, which will then essentially “subpoena” the video. “If we ask within 60 days of the recording and as long as it’s been uploaded to the cloud, then Ring can take it out of the cloud and send it to us legally so that we can use it as part of our investigation,” he said." source: https://www.govtech.com/security/Amazons-Ring-Video-Camera-Alarms-Privacy-Advocates.html https://www.govtech.com/security/Amazons-Ring-Video-Camera-A... Amazon can pretty much do whatever they want with your video feed including publish views from your doorstep on social media without your permission: https://www.buzzfeednews.com/article/daveyalba/amazon-ring-doorbell-company-using-security-footage-for-ads https://www.buzzfeednews.com/article/daveyalba/amazon-ring-d... Police have also shown up at people's doors to intimidate them into handing over videos. "Police have also told CNET in the past that they've shown up at known Ring users' doorsteps to request footage in person if the online requests don't pan out." source: https://www.cnet.com/news/amazon-ring-wants-police-to-keep-these-surveillance-details-from-you/ https://www.cnet.com/news/amazon-ring-wants-police-to-keep-t... This shouldn't surprise you though. Basically any scrap of data you give to companies like apple google and amazon will be sucked up by the government at some level. Just the other day there was an article about how companies are hit with national security letters forbidding them from saying anything about the data collection going on, but we've known since Snowden's leaks that the NSA was collecting data from those companies already.