3 ms·

This is a cool and super creative project, but I think the simpler solution would be to not buy a device that listens to all of your conversations at home, or a

This is a cool and super creative project, but I think the simpler solution would be to not buy a device that listens to all of your conversations at home, or at least switch it off when not needed. And if you're exposed to such a device as a guest in someone else's home or office, kindly ask the owner to switch it off and explain why you think it's not good to have such a device listening to all conversations you're having. It would also not be so hard to make such devices more privacy-friendly e.g. by giving users are clearer indication of when they're listening to you and when they transfers data to the cloud. I think Amazon already allows you to review and download all audio conversations they have from you (in theory this is mandatory in the EU).

Wowfunhappy 7y ago
Every phone has a microphone, and it too is always on. Are you going to ask everyone to turn off their phone?
- Thriptic 7y ago
  This is what I don't understand. Everyone runs around terrified of these smart speakers but have no problem talking around their phones which have mics, their computers which have mics, other devices which have mics, CCTV cameras which are ubiquitous, etc Do people realistically think attackers are going to start burning zero days against these things to listen to the average Joe's kitchen conversations or bedroom chatter? What is the threat model here?
  - ThePhysicist 7y ago
    You confuse privacy with security I think. Smart home assistants might be secure but they are not privacy-friendly, that's a difference.
    - Thriptic 7y ago
      I follow, but what exactly is the real privacy threat here? If we look at an echo for instance: * The device is hardwired to light up whenever it is listening so you can't be eavesdropped on without some indicator. * The device only transmits when it is in listening mode. This has been validated independently by multiple people. * The device has a mute function (granted, software). * The device can be registered under a bogus account. * You can turn off all phone call capabilities / external listening capabilities. * You can pihole it so it won't reach back to Amazon's ad services. * You can delete any conversation you don't want stored manually, including one click deleting your entire history. * You can have all content automatically deleted after X days. So what exactly are people concerned about? Out of all the convos someone could have, a negative one just happens to probabilistically be recorded, you don't notice, and within 90 days someone in law enforcement or entity X figures it out and uses it against you? Someone at Amazon decides to look through your stored conversations and sees you turn on the lights at 5 PM each day? I'm not saying there are 0 privacy implications with this device, as any device that has a mic and can record remotely has privacy implications. I just feel like the level of angst generated by smart speakers isn't warranted in the grander scheme of things.
      - deleted 7y ago
        [deleted]
      - ThePhysicist 7y ago
        Well it’s totally fine to have that opinion and use those devices, personally I wouldn’t though. Privacy is a niche topic right now and it might stay that way, but I think more and more people will become concerned about what large companies know about them. Each individual service and datapoint is not very critical as you say, combining data from multiple sources and using the data in unexpected ways can quickly reveal very intimate things about a person though. Companies like Amazon, Google and FB do not mainly use your data to “improve your experience”, they use it to nudge you into behavioral patterns that benefit their business model (i.e. look at more ads or buy more stuff). I doesn’t take so much imagination to see how this might harm you e.g. because you develop unhealthy spending habits or waste large amounts of time on social media. And the more data a company has about you, the easier it is for them to manipulate you. So for me it’s not about defending against an unknown attacker, it’s defending against companies using my data to manipulate me, which they might do even if they keep my data very, very secure.
- ThePhysicist 7y ago
  As far as I know, phones don't permanently listen and transmit data to the cloud, like most home assistants do when they're (accidentally) activated by a cue word.
  - Wowfunhappy 7y ago
    All modern iPhones and many Android phones can also activate either Siri or Google Assistant when they hear a cue word. And if that gets triggered accidentally, they'll send what they record to the cloud. Exactly like dedicated assistants.
- stubish 7y ago
  No, you tell Apple and Google that the microphone needs to be off except when the user activates it (eg. answering or making a phone call). This might be acceptable to society depending on how many people want non-handheld voice activated devices in public.

Wowfunhappy 7y ago

Every phone has a microphone, and it too is always on. Are you going to ask everyone to turn off their phone?

Thriptic 7y ago
This is what I don't understand. Everyone runs around terrified of these smart speakers but have no problem talking around their phones which have mics, their computers which have mics, other devices which have mics, CCTV cameras which are ubiquitous, etc Do people realistically think attackers are going to start burning zero days against these things to listen to the average Joe's kitchen conversations or bedroom chatter? What is the threat model here?
- ThePhysicist 7y ago
  You confuse privacy with security I think. Smart home assistants might be secure but they are not privacy-friendly, that's a difference.
  - Thriptic 7y ago
    I follow, but what exactly is the real privacy threat here? If we look at an echo for instance: * The device is hardwired to light up whenever it is listening so you can't be eavesdropped on without some indicator. * The device only transmits when it is in listening mode. This has been validated independently by multiple people. * The device has a mute function (granted, software). * The device can be registered under a bogus account. * You can turn off all phone call capabilities / external listening capabilities. * You can pihole it so it won't reach back to Amazon's ad services. * You can delete any conversation you don't want stored manually, including one click deleting your entire history. * You can have all content automatically deleted after X days. So what exactly are people concerned about? Out of all the convos someone could have, a negative one just happens to probabilistically be recorded, you don't notice, and within 90 days someone in law enforcement or entity X figures it out and uses it against you? Someone at Amazon decides to look through your stored conversations and sees you turn on the lights at 5 PM each day? I'm not saying there are 0 privacy implications with this device, as any device that has a mic and can record remotely has privacy implications. I just feel like the level of angst generated by smart speakers isn't warranted in the grander scheme of things.
    - deleted 7y ago
      [deleted]
    - ThePhysicist 7y ago
      Well it’s totally fine to have that opinion and use those devices, personally I wouldn’t though. Privacy is a niche topic right now and it might stay that way, but I think more and more people will become concerned about what large companies know about them. Each individual service and datapoint is not very critical as you say, combining data from multiple sources and using the data in unexpected ways can quickly reveal very intimate things about a person though. Companies like Amazon, Google and FB do not mainly use your data to “improve your experience”, they use it to nudge you into behavioral patterns that benefit their business model (i.e. look at more ads or buy more stuff). I doesn’t take so much imagination to see how this might harm you e.g. because you develop unhealthy spending habits or waste large amounts of time on social media. And the more data a company has about you, the easier it is for them to manipulate you. So for me it’s not about defending against an unknown attacker, it’s defending against companies using my data to manipulate me, which they might do even if they keep my data very, very secure.
ThePhysicist 7y ago
As far as I know, phones don't permanently listen and transmit data to the cloud, like most home assistants do when they're (accidentally) activated by a cue word.
- Wowfunhappy 7y ago
  All modern iPhones and many Android phones can also activate either Siri or Google Assistant when they hear a cue word. And if that gets triggered accidentally, they'll send what they record to the cloud. Exactly like dedicated assistants.
stubish 7y ago
No, you tell Apple and Google that the microphone needs to be off except when the user activates it (eg. answering or making a phone call). This might be acceptable to society depending on how many people want non-handheld voice activated devices in public.