6 ms·

Who's listening? Growing privacy concerns around transcription services (2020)

fwn 6y ago
The main message here seems pretty straightforward and is only lightly related to transcription: If you gather confidential information do not hand them over to some third party for transcription, storage, sync, cloud office solutions, etc. I feel that this is quite a basic truth and packaging it in such a long essay makes me think that most people on HN might not be the articles target group. It was still fun to read though.
ganafagol 6y ago
Combine this with the article about brain-to-machine connections earlier today and you are deep in a privacy-nightmare dystopia.
jabo 6y ago
Privacy concern is the main reason we still have a local-only mode in our transcription app [1]. It’s a web-app, but we play the audio/video file directly from the user’s computer, and we use local storage to store typed text in users’ browsers. This way no transcription data leaves users’ computers. We also use service workers to allow this mode to work offline, for good measure. We’ve been working on it for over a decade and we did add machine transcription recently, but I still find a surprising number of users use and ask about the local-only “Self Transcription” mode. One interesting side-effect of a local-only mode is that we can’t sync transcript data between computers. And this sometimes surprises people. Once we explain that this is actually a feature not a bug, since we don’t store the data on our servers to be able to do the sync, it actually seems to reassure people even more. [1] https://transcribe.wreally.com https://transcribe.wreally.com
- lupire 6y ago
  A post on HN yesterday said Local Storage is not secure from XSS attacks.
  - jabo 6y ago
    Thanks for sharing. Just read through it and like one of the comments mentioned, if malicious JS is able to run on any site, that’s a larger issue and would affect not just local storage right?
    - UweSchmidt 6y ago
      Someone would have to make specific JS to target your specific app/service and specific users, as well as in some way "launder" the stolen data. Totally different 'order of magnitude' from automatically and legally taking the users' data. I hope this is the correct way to evaluate these kind of things?
  - gruez 6y ago
    And that's fine right? If it was a desktop app instead, you could say that it's not secure against sandbox escapes and stack smashing attacks. It's still a step-up in security compared to cloud transcription services, and for most use cases perfectly adequate.
- Jon_Lowtek 6y ago
  This "privacy concerned" app has a myriad of analytics and tracking scripts which can read the transcript in local storage or log key presses (but are hopefully not be configured that way). Typical privacy friendly defaults like google analytics anonymize_ip are not set. There are no checks for the integrity of these third party scripts (a hack against them can lead to a breach of the app) and it does not ask for consent before connecting the user to these third party servers. There is also an error logging service (datadog) and i have seen other apps push all state info, including local storage and auth tokens, when any error happens. The promise of the recording and transcript not leaving the users computer in local-only mode may be true, if its implemented correctly. The privacy policy looks halfway decent, a bit chaotic with no ToC and free-floating "legal basis" & "retention policy" that are independent from the concrete processing tasks, leaving them as abstract "we know the law" blocks of little value. The policy is very dominated by all the user behavior tracking and ad-tech integrations, while the processing of recordings/transcriptions is rather short. In a way that is good, but it is almost too short, given that it is the primary function: "transcripts" and "recordings" are not even a category of data in their policy, and they are not mentioned with any sub-processor, not even by the ones running the servers (a rather curious formal error, as one would assume a focus on their core business). There is a complete lack of "we keep small samples to improve the ML/AI" which i find inteersting, but which might be true. There is a small note in the legal texts that the user must have the consent of the recorded people before uploading recordings to the server for automatic transcriptions, but there does not seem to be one in proximity to the upload function. (or at least they are missing from the screenshots in the guides, i did not register for a trial)
dsnr 6y ago
Pro tip: Jump to paragraph 11 to skip the life story of the random person and get to the point.
- StavrosK 6y ago
  What's with the fad where articles start by describing how a random person overpacked? It's such a cliche by now, yet I see it everywhere.
  - loceng 6y ago
    We're story tellers with lives, perhaps it allows a person to feel like they're more than a cog in a wheel existing just to please some impatient internet stranger?
    - lupire 6y ago
      Communication is about co: sharing information that is wanted to be sent and wanted to be received. Readers aren't meant to be a captive audience for shaggy dog tales. The article is on the review of Journalism website, not a storytelling website. Overpacking a story with junk (how ironic!) makes it harder to spread the important ideas of the article, which hurts the author's goal.
      - loceng 6y ago
        Oh, you know the author's goal? Likewise, if it was published on the site - arguably the curators read the article and approved it - but because it doesn't fit your own expectations of the only kind of content you want there, then it's inappropriate? That sounds like gatekeeping and perhaps perfectionism.
      - wpietri 6y ago
        Different people like different things. Rather than assuming the author, the editor, and various other reviewers are all idiots, perhaps consider that you are not representative of their typical audience.
cproctor 6y ago
Can anyone provide an update on the state of open-source transcription packages, with language models? I'd love to have the equivalent of spaCy, gensim, Stanford NLP, or NLTK, but for transcription. That is, packages that will just work at quality comparable to cloud transcription APIs if you generally know what you're doing but maybe don't keep up with the latest literature.
- electriccello 6y ago
  Vosk does a solid job, and there are a couple other alternatives. Trouble is, the bottleneck for quality here is dataset size/quality/availability, so closed-source models with private data have the leg up.
jfd98njkdgnh 6y ago
And in some places, those are hard to avoid. My school in previous semester had a class that required online meetings that were recorded and transcriped with no way to opt out without affecting your grade. And explaining my beefs to professors is getting harder and harder ( ie. for an outside viewer it looks like I am not being reasonable ).
ghaff 6y ago
For air-gapped recordings the technique that one person mentions (locally record and make brief notes/timing of important parts of the conversation--there are devices that will do this semi-automatically) is probably the best approach. I'd also note that ML transcriptions are useful in the context of this article, i.e. to get rough cheap transcripts. But, if you value your time above minimum wage, human transcription is a lot better if you actually want to publish a transcript of an interview.
deleted 6y ago
[deleted]
julianna01k 6y ago
At https://audext.com/ https://audext.com/ your privacy and security are very important to us. All uploaded files are stored securely, are used exclusively for transcription and can be deleted manually or after a time limit.

fwn 6y ago

The main message here seems pretty straightforward and is only lightly related to transcription: If you gather confidential information do not hand them over to some third party for transcription, storage, sync, cloud office solutions, etc. I feel that this is quite a basic truth and packaging it in such a long essay makes me think that most people on HN might not be the articles target group. It was still fun to read though.

ganafagol 6y ago

Combine this with the article about brain-to-machine connections earlier today and you are deep in a privacy-nightmare dystopia.

jabo 6y ago

Privacy concern is the main reason we still have a local-only mode in our transcription app [1]. It’s a web-app, but we play the audio/video file directly from the user’s computer, and we use local storage to store typed text in users’ browsers. This way no transcription data leaves users’ computers. We also use service workers to allow this mode to work offline, for good measure. We’ve been working on it for over a decade and we did add machine transcription recently, but I still find a surprising number of users use and ask about the local-only “Self Transcription” mode. One interesting side-effect of a local-only mode is that we can’t sync transcript data between computers. And this sometimes surprises people. Once we explain that this is actually a feature not a bug, since we don’t store the data on our servers to be able to do the sync, it actually seems to reassure people even more. [1] https://transcribe.wreally.com https://transcribe.wreally.com

lupire 6y ago
A post on HN yesterday said Local Storage is not secure from XSS attacks.
- jabo 6y ago
  Thanks for sharing. Just read through it and like one of the comments mentioned, if malicious JS is able to run on any site, that’s a larger issue and would affect not just local storage right?
  - UweSchmidt 6y ago
    Someone would have to make specific JS to target your specific app/service and specific users, as well as in some way "launder" the stolen data. Totally different 'order of magnitude' from automatically and legally taking the users' data. I hope this is the correct way to evaluate these kind of things?
- gruez 6y ago
  And that's fine right? If it was a desktop app instead, you could say that it's not secure against sandbox escapes and stack smashing attacks. It's still a step-up in security compared to cloud transcription services, and for most use cases perfectly adequate.
Jon_Lowtek 6y ago
This "privacy concerned" app has a myriad of analytics and tracking scripts which can read the transcript in local storage or log key presses (but are hopefully not be configured that way). Typical privacy friendly defaults like google analytics anonymize_ip are not set. There are no checks for the integrity of these third party scripts (a hack against them can lead to a breach of the app) and it does not ask for consent before connecting the user to these third party servers. There is also an error logging service (datadog) and i have seen other apps push all state info, including local storage and auth tokens, when any error happens. The promise of the recording and transcript not leaving the users computer in local-only mode may be true, if its implemented correctly. The privacy policy looks halfway decent, a bit chaotic with no ToC and free-floating "legal basis" & "retention policy" that are independent from the concrete processing tasks, leaving them as abstract "we know the law" blocks of little value. The policy is very dominated by all the user behavior tracking and ad-tech integrations, while the processing of recordings/transcriptions is rather short. In a way that is good, but it is almost too short, given that it is the primary function: "transcripts" and "recordings" are not even a category of data in their policy, and they are not mentioned with any sub-processor, not even by the ones running the servers (a rather curious formal error, as one would assume a focus on their core business). There is a complete lack of "we keep small samples to improve the ML/AI" which i find inteersting, but which might be true. There is a small note in the legal texts that the user must have the consent of the recorded people before uploading recordings to the server for automatic transcriptions, but there does not seem to be one in proximity to the upload function. (or at least they are missing from the screenshots in the guides, i did not register for a trial)

dsnr 6y ago

Pro tip: Jump to paragraph 11 to skip the life story of the random person and get to the point.

StavrosK 6y ago
What's with the fad where articles start by describing how a random person overpacked? It's such a cliche by now, yet I see it everywhere.
- loceng 6y ago
  We're story tellers with lives, perhaps it allows a person to feel like they're more than a cog in a wheel existing just to please some impatient internet stranger?
  - lupire 6y ago
    Communication is about co: sharing information that is wanted to be sent and wanted to be received. Readers aren't meant to be a captive audience for shaggy dog tales. The article is on the review of Journalism website, not a storytelling website. Overpacking a story with junk (how ironic!) makes it harder to spread the important ideas of the article, which hurts the author's goal.
    - loceng 6y ago
      Oh, you know the author's goal? Likewise, if it was published on the site - arguably the curators read the article and approved it - but because it doesn't fit your own expectations of the only kind of content you want there, then it's inappropriate? That sounds like gatekeeping and perhaps perfectionism.
    - wpietri 6y ago
      Different people like different things. Rather than assuming the author, the editor, and various other reviewers are all idiots, perhaps consider that you are not representative of their typical audience.

cproctor 6y ago

Can anyone provide an update on the state of open-source transcription packages, with language models? I'd love to have the equivalent of spaCy, gensim, Stanford NLP, or NLTK, but for transcription. That is, packages that will just work at quality comparable to cloud transcription APIs if you generally know what you're doing but maybe don't keep up with the latest literature.

electriccello 6y ago
Vosk does a solid job, and there are a couple other alternatives. Trouble is, the bottleneck for quality here is dataset size/quality/availability, so closed-source models with private data have the leg up.

jfd98njkdgnh 6y ago

And in some places, those are hard to avoid. My school in previous semester had a class that required online meetings that were recorded and transcriped with no way to opt out without affecting your grade. And explaining my beefs to professors is getting harder and harder ( ie. for an outside viewer it looks like I am not being reasonable ).

ghaff 6y ago

For air-gapped recordings the technique that one person mentions (locally record and make brief notes/timing of important parts of the conversation--there are devices that will do this semi-automatically) is probably the best approach. I'd also note that ML transcriptions are useful in the context of this article, i.e. to get rough cheap transcripts. But, if you value your time above minimum wage, human transcription is a lot better if you actually want to publish a transcript of an interview.

deleted 6y ago

[deleted]

julianna01k 6y ago

At https://audext.com/ https://audext.com/ your privacy and security are very important to us. All uploaded files are stored securely, are used exclusively for transcription and can be deleted manually or after a time limit.