5 ms·

Phones only listen when you use them. Speakers listen all the time. Phone calls are usually not transcribed where speaker recordings are, and can be searched ba

Phones only listen when you use them. Speakers listen all the time. Phone calls are usually not transcribed where speaker recordings are, and can be searched back in time as well. Phone calls are not recorded, though metadata is. So basically a “smart speaker” is like having 24/7/365 surveillance in your home.

servercobra 6y ago
Both the phones and smart speakers start listening on wake words. I haven't seen any thing to suggest the smart speakers are constantly listening and sending everything to Amazon/Google/Apple. But both clearly could be constantly recording, not just when you're making a phone call. They're the same threat model, in my opinion. Plus the phone goes with you to places the speaker doesn't.
- TehCorwiz 6y ago
  If it's not listening, then how does it hear the wake word? Hint, it is. It just doesn't start parsing the request until it hears the wake word.
  - arpa 6y ago
    Unless you explicitly turn it off.
shuntress 6y ago
Maybe a Google engineer can correct me but I'm pretty sure there is no meaningful distinction to be drawn between the Google Assistant running on the Home devices and the Google Assistant running on phones. Having a "smart phone" is also like having 24/7/365 surveillance in your home.
- danShumway 6y ago
  Voice assistants on phones can be set to only trigger on manual interaction, and they can be turned off entirely. Having an always on voice assistant is like having 24/7/365 surveillance in your home, regardless of what device it's on. But having a smart phone does not require you to have an always on voice assistant.
  - danso 6y ago
    But how is the action (e.g. an over-the-air patch/hack) needed to secretly convert an Alexa to always-listen-and-transmit-home different than it would be for a smartphone?
    - danShumway 6y ago
      I'm not worried about an over-the-air patch or hack[0], I'm worried about the existing problem Alexa has with false positive wakewords. Voice recognition isn't reliable enough yet to use as a security feature. https://www.vox.com/recode/2020/2/21/21032140/alexa-amazon-google-home-siri-apple-microsoft-cortana-recording https://www.vox.com/recode/2020/2/21/21032140/alexa-amazon-g... https://www.independent.co.uk/life-style/gadgets-and-tech/news/amazon-echo-alexa-record-conversation-privacy-security-a8368231.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne... [0]: I mean, I am, but not in this specific case. I don't think smart speakers represent a particularly unique risk where hacking is concerned (Nest devices excluded).
  - jnwatson 6y ago
    The entire point is that you're trusting the manufacturer that the device implement the behavior the manufacturer says it does. If you have a smart speaker, you're trusting they don't upload all speech. With a cell phone, it is actually tougher, because you're also trusting the manufacturer that their security model is such that 3rd party software can't violate the privacy policy you're expecting. Many, many free phone apps today collect data you don't want them to.
    - danShumway 6y ago
      > If you have a smart speaker, you're trusting they don't upload all speech. Well, you shouldn't be doing that because we've known for a while that smart speakers have a false-positive problem. That's the advantage of a physical gesture; the AI won't get it wrong. A physical action like holding down your home button is much less likely to trigger on accident. Not to mention, you can also full-on disable the voice assistant on your smartphone, in which case, there's practically zero risk of a false positive. > With a cell phone, it is actually tougher, because you're also trusting the manufacturer that their security model is such that 3rd party software can't violate the privacy policy you're expecting. Stealing my contacts is bad, getting access to my microphone is worse. If the argument is, "my phone might get malware, so having an always-on-microphone is exactly the same", that just seems really fatalistic to me. These are different risks that belong in different categories.

servercobra 6y ago

Both the phones and smart speakers start listening on wake words. I haven't seen any thing to suggest the smart speakers are constantly listening and sending everything to Amazon/Google/Apple. But both clearly could be constantly recording, not just when you're making a phone call. They're the same threat model, in my opinion. Plus the phone goes with you to places the speaker doesn't.

TehCorwiz 6y ago
If it's not listening, then how does it hear the wake word? Hint, it is. It just doesn't start parsing the request until it hears the wake word.
- arpa 6y ago
  Unless you explicitly turn it off.

shuntress 6y ago

Maybe a Google engineer can correct me but I'm pretty sure there is no meaningful distinction to be drawn between the Google Assistant running on the Home devices and the Google Assistant running on phones. Having a "smart phone" is also like having 24/7/365 surveillance in your home.

danShumway 6y ago
Voice assistants on phones can be set to only trigger on manual interaction, and they can be turned off entirely. Having an always on voice assistant is like having 24/7/365 surveillance in your home, regardless of what device it's on. But having a smart phone does not require you to have an always on voice assistant.
- danso 6y ago
  But how is the action (e.g. an over-the-air patch/hack) needed to secretly convert an Alexa to always-listen-and-transmit-home different than it would be for a smartphone?
  - danShumway 6y ago
    I'm not worried about an over-the-air patch or hack[0], I'm worried about the existing problem Alexa has with false positive wakewords. Voice recognition isn't reliable enough yet to use as a security feature. https://www.vox.com/recode/2020/2/21/21032140/alexa-amazon-google-home-siri-apple-microsoft-cortana-recording https://www.vox.com/recode/2020/2/21/21032140/alexa-amazon-g... https://www.independent.co.uk/life-style/gadgets-and-tech/news/amazon-echo-alexa-record-conversation-privacy-security-a8368231.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne... [0]: I mean, I am, but not in this specific case. I don't think smart speakers represent a particularly unique risk where hacking is concerned (Nest devices excluded).
- jnwatson 6y ago
  The entire point is that you're trusting the manufacturer that the device implement the behavior the manufacturer says it does. If you have a smart speaker, you're trusting they don't upload all speech. With a cell phone, it is actually tougher, because you're also trusting the manufacturer that their security model is such that 3rd party software can't violate the privacy policy you're expecting. Many, many free phone apps today collect data you don't want them to.
  - danShumway 6y ago
    > If you have a smart speaker, you're trusting they don't upload all speech. Well, you shouldn't be doing that because we've known for a while that smart speakers have a false-positive problem. That's the advantage of a physical gesture; the AI won't get it wrong. A physical action like holding down your home button is much less likely to trigger on accident. Not to mention, you can also full-on disable the voice assistant on your smartphone, in which case, there's practically zero risk of a false positive. > With a cell phone, it is actually tougher, because you're also trusting the manufacturer that their security model is such that 3rd party software can't violate the privacy policy you're expecting. Stealing my contacts is bad, getting access to my microphone is worse. If the argument is, "my phone might get malware, so having an always-on-microphone is exactly the same", that just seems really fatalistic to me. These are different risks that belong in different categories.