8 ms·

I have no doubt they are able to hear anything happening in the room they happen to be installed in. But I doubt they listen for anything but their keyword, an

• rhino369 7y ago
  >However, they clearly CAN, and while they almost certainly don't on any massive scale, if they by their overlord or a security hack, did on a targeted basis listen, record and send conversations on, that would be very possible, and very harmful for whoever was targeted. Besides the fact that they have better antennas, this is true for pretty much any device with a microphone and a processor with audio processing capability, no? My laptop has a microphone and video. Surely Microsoft could just start recording with the with right windows update? My Avaya VOIP phone has speaker phone, could do the same.
  • masklinn 7y ago
    > My laptop has a microphone and video. Surely Microsoft could just start recording with the with right windows update? It's a commonly mentioned issue, and a somewhat regular occurrence with various malware or "security solutions". That's why a number of laptops have either visual indicators or shutters (though mostly for the cameras, sadly hot mics are rarely a consideration), and a rare few have physical disconnection switches (again mostly for cameras).
    • pampelondan 7y ago
      I saw one gizmo for mic the other day https://shop.googlemerchandisestore.com/Google+Redesign/Accessories/Google+See+no+hear+no+set https://shop.googlemerchandisestore.com/Google+Redesign/Acce... haven't tried it though, anyone has any experience? Does it really muffle the sound enough?
      • snovv_crash 7y ago
        I think the idea there is that it physically disconnects the mic, since the laptop instead tries to use the headphone mic (which in this case isn't connected). Not sure if it would actually work, it would be easy to 3d-print one to test.
        • rebuilder 7y ago
          If you connect a plug to the audio jack, sure, the laptop probably defaults to using that jack for input and output. But you can still choose to use the built-in mic, right? So it's not physically disconnecting anything, just triggering a software disconnect.
          • masklinn 7y ago
            AFAIK you're correct. Though it's possible most spying software just uses the default mic and doesn't have the capabilities to switch the input device?
            • to11mtm 7y ago
              Not a Mac user, and the last time I played with sound stuff in nix was almost 15 years ago... But I feel like switching input (or even collecting multiple sound inputs) on a nix OS is not much more convoluted than dealing with the sound stack in general. But that's probably also related to how the driver itself interfaces with the audio device...
    • tprynn 7y ago
      Macbooks since 2018 physically disable microphones and webcams when the lid is closed: https://www.businessinsider.com/apple-macbook-air-and-2018-macbook-pro-disconnect-microphone-when-lid-is-closed-2018-11 https://www.businessinsider.com/apple-macbook-air-and-2018-m...
      • netsharc 7y ago
        How does a chip "physically disconnects" a device?
        • tprynn 7y ago
          Presumably power is disconnected by the T2 chip. Different from mechanical disconnect via a physical switch, but equivalently effective if you trust the T2 chip. (And if you don’t ... well, you can’t use the MacBook securely at all.)
          • morpheuskafka 7y ago
            You had better not trust the T2 chip, because it is vulnerable to the checkm8 exploit and the checkra1n folks have already demonstrated total compromise. The encryption functionality isn't affected if you have FileVault on, because your password is not stored anywhere on the device, but everything else, from basic SMC functions like mic/cam/fans/touchbar to secure boot to verifying the microcode and ME firmware before loading are totally useless now. AFAIK, the T2 is always powered on even when the main CPU is off, so this could have ultra-long-term persistence.
            • yborg 7y ago
              Reference?
              • walterbell 7y ago
                https://www.idownloadblog.com/2020/03/10/luca-todesco-teases-checkra1n-hacks-on-a-t2-equipped-macbook-pros-touch-bar/ https://www.idownloadblog.com/2020/03/10/luca-todesco-teases...
    • eth0up 7y ago
      Perhaps within the hazy, inextricable mists of jack, pulse and alsa, there's an answer. I remember feeling qualified for a job at NSA after getting midi and my mic to work (effectively) on my Arch (Mint, Ubuntu, Debian, etc) laptops years ago. It was a feat. I can see: Hacker1: we've got root. Hacker2: yeah, but how the fuck do we get audio to work? Hacker1: modify grub to default to windows partition and reboot, or maybe install Virtual Box and run windows. Probably not possible otherwise. Hacker2: No, waaay too slow, they're on an ATT gateway. Find a softer target.
  • im3w1l 7y ago
    > Surely Microsoft could just start recording with the with right windows update? Yes, that's why automatic updates was seen with a lot of skepticism at first. And the reason automatic updates are winning is because everything is so full of holes that disabling automatic updates is even less secure than enabling it.
  • Silhouette 7y ago
    Surely Microsoft could just start recording with the with right windows update? Yes, they could. I get some scepticism when I say my businesses have declined to move to Windows 10, mostly because we don't trust the security and privacy aspects. However, we deal with personal data, and we also deal with various types of information that are protected by statute and/or contract. It would be very obviously against the spirit and quite possibly against the letter of several different laws for us to knowingly store and use that kind of data on a system that sends information we can't control up to the mothership and/or that could be updated without us agreeing to it. Indeed, there are multiple ongoing investigations into Windows 10 because of exactly those kinds of concerns across the EU right now. It's a good thing that non-technical people who do take privacy seriously, such as lawyers, are starting to notice the glaring problem with these modern technologies and advise against using them. With a bit of luck, we'll then get statutory regulation requiring disclosure in advance of exactly what these devices are doing and the security and privacy implications including when they don't work properly or if they get compromised. Again, there had been much discussion in Europe recently, at least up until the world was more concerned with another kind of virus over the past few weeks, of requiring much stronger standards for security in IoT devices, and those sorts of laws really can't arrive soon enough. Mandating controls to physically isolate all cameras, microphones, transmitters and receivers at the hardware level might not be a bad idea, either.
• mrfusion 7y ago
  Also what’s stopping them processing advertising relevant keywords locally and then just sending a list of keywords to amazon.
  • shawnz 7y ago
    Now that they've publicly claimed several times that they don't do that, I think it would really erode trust in the product if they changed the policy.
    • a3n 7y ago
      Not much beyond those here assembled.
• fulafel 7y ago
  There were stories earlier about Alexa employees and contractors hearing all kinds of unintended conversations. https://www.latimes.com/business/la-fi-tn-amazon-alexa-echo-privacy-listening-20190411-story.html https://www.latimes.com/business/la-fi-tn-amazon-alexa-echo-...
  • masklinn 7y ago
    It should be noted that the device is not intended to record conversations absent the trigger word, however there can be false positives: > According to Amazon’s website, no audio is stored unless Echo detects the wake word or is activated by pressing a button. But sometimes Alexa appears to begin recording without any prompt at all, and the audio files start with a blaring television or unintelligible noise.
    • fulafel 7y ago
      Well, from a suspicious mindset that could be more or less sincere...
      • MereInterest 7y ago
        It doesn't even matter how sincere they are. False negatives hurt the perception of the product, because then people need to repeat the key word. False positives do not hurt the perception of the product, because the recording occurs silently. Their incentives are aligned against privacy, and so privacy will suffer.
        • vidarh 7y ago
          False positives does hurt the perception, because the device will usually do something or utter a response unless it fails to detect something intelligible or writes the request off as not intended for it (having two devices at opposite ends of a large open space living area can sometimes get frustrating, but looking at the history, you see how often they correctly determine which device should respond) An occasional false positive is funny, but it gets old pretty quickly.
• sys_64738 7y ago
  Where is the keyword 'Alexa' recognized? On the device or back in Amazon towers? If the latter then every sounds is transmitted back to grep for 'Alexa'. Of course we believe they don't store that other noise data.
  • misnome 7y ago
    On device.
  • numpad0 7y ago
    Usually done by dedicated software on a separate CPU that captures “wakeword”(mostly for technical reasons than privacy)
  • xyzzy_plugh 7y ago
    Both. First on the device, then in the cloud. The latter determines if it's a "false positive" or not. AFAIK there is no way to remotely start recording up to the cloud.
    • MrStonedOne 7y ago
      The cloud can push changes to the wake word (because changing it by the app is possible), it can add new ones, and the real question is rather or not amazon servers can instruct it to not turn the lights on for certain wake words. You can see this in their home defense feature on the echos, where the echo can have the sounds of broken glass and wood breaking added as wake words so it can notify you and/or police in the event of an intruder.
• einpoklum 7y ago
  > But I doubt they listen for anything but their keyword > I can't imagine the NSA and other covert organizations not drooling at the chance to do just that. Why doubt? Why imagine? You know that, for data on big corporation's servers, the NSA already gets a copy of everything - and everything is recorded forever without you really being able to delete it. Why would this be so different for voluntary self-espionage devices (Alex, Dot etc.)? It a reasonable assumption that a lot more recording happens than is claimed.
  • lima 7y ago
    > You know that, for data on big corporation's servers, the NSA already gets a copy of everything This is squarely in conspiracy theory realm. Nothing in the Snowden documents or other leaks hinted at this (except for the NSA snooping on unencrypted internal links, which is useless now that everyone encrypts everything). > Why would this be so different for voluntary self-espionage devices (Alex, Dot etc.)? Why would a big tech company willfully infringe on their customer's privacy? How would they even do it? They have every reason to prevent it.
    • wolco 7y ago
      The Snowden documents are old now while this has become the hottest gift. "Why would a big tech company willfully infringe on their customer's privacy?" to comply with a national security order. These companies are not lawless entities fighting for good.
      • lima 7y ago
        I don't think NSL can even be used request the actual content of the recordings (vs. "just" the metadata) - a judge would have to sign off on that. Now, clearly there's a lot of questionable practices like secret courts, gag orders and ineffective oversight in general, but this is still far from "for data on big corporation's servers, the NSA already gets a copy of everything", and very far from "being forced to deploy a firmware update that turns a smart home devices into a bug". Companies act exclusively in their own interests, which I would hope includes to not engage in covert surveillance of their own customers. This will only stay this way if we keep demanding and expecting privacy, and push for stronger oversight. But defeatist claims like "the NSA gets all data anyway" are not useful.
• vidarh 7y ago
  They do accidentally trigger very often, though. If you have Alexa devices and check the history, it often records fragments of things that were not intended for it. If I was to have a very sensitive conversation, I'd unplug them. But day to day it really does not concern me (or I wouldn't have four of them around the house...)
• wolco 7y ago
  They could be under a court order to record certain keywords and we wouldn't know similiar to our telephones. If they are not doing this now they will be.
• willhslade 7y ago
  The FBI has been doing this for 15 years with cars and OnStar. They will do this with smart speakers once enough people have them. https://www.forbes.com/sites/thomasbrewster/2017/01/15/police-spying-on-car-conversations-location-siriusxm-gm-chevrolet-toyota-privacy/amp/ https://www.forbes.com/sites/thomasbrewster/2017/01/15/polic...
  • dmix 7y ago
    2006: The FBI admits for the first time to turning a dumb phone into a microphone to listen in on a some New York mafia guys conversations at a restaurant in the early days even before smartphones made it even easier to do so. Which they publicly used to convict them (meaning it was probably an old tactic by then): > The FBI appears to have begun using a novel form of electronic surveillance in criminal investigations: remotely activating a mobile phone's microphone and using it to eavesdrop on nearby conversations. https://www.cnet.com/news/fbi-taps-cell-phone-mic-as-eavesdropping-tool/ https://www.cnet.com/news/fbi-taps-cell-phone-mic-as-eavesdr...
  • rapind 7y ago
    And we can't reign it in cause terrorism!
• zie 7y ago
  I like that despite all the comments, nobody called me on "by and large the tech industry has a complete failure rate at making anything computing related secure. " Which I figured someone would raise a fuss about. It makes me sad that we can say that and just accept it. It shouldn't be this way.