7 ms·

I like that this makes it easy to completely avoid Amazon devices and to not recommend them to your non-technical friends. I don't care if the data amount is p

I like that this makes it easy to completely avoid Amazon devices and to not recommend them to your non-technical friends. I don't care if the data amount is piddlingly small, the simple fact is you let somebody outside your trusted network of friends and family onto your personal broadband, you lose control of what criminal activities get undertaken. There is no way I am exposing myself to that kind of liability and Amazon won't be selling me or my family anything.

unyttigfjelltol 5y ago
A phone app that did this would be malware. When Alexa does it, this is a feature?
- efitz 5y ago
  You mean, like AirTag/Find My? I think that Amazon's marketing for this is horrible, reminds me of XBox' failed marketing around their online-only plan for XBox One game purchases [1]. But really all they've done is built AirTags as a platform rather than an application, e.g. Tile is supported by Amazon's new platform. I don't want to give random people with random apps any amount of arbitrary bandwidth; I'd rather that users of the Sidewalk platform would have to register app specific message types publicly (to ensure transparency) and with Amazon (who should enforce message type and payload restrictions). [1] https://arstechnica.com/gaming/2013/06/xbox-one-eighty-microsoft-fails-to-sell-the-future-retreats-to-the-past/ https://arstechnica.com/gaming/2013/06/xbox-one-eighty-micro...
  - clajiness 5y ago
    > You mean, like AirTag/Find My? Can you explain your comparison?
    - efitz 5y ago
      Any AirTag owned by anybody can and will communicate with your iPhone over Bluetooth if you have the right features enabled (which are default). Your phone will contact Apple and tell them about the interaction. I haven’t seen protocol details, but last week a security researcher demonstrated that it is possible to use the AirTags protocol as a covert channel (with very low bandwidth).
      - bottled_poe 5y ago
        not great, but not the same as open connectivity to unknown devices.
        SN76477 5y ago
        No, it isn’t a great comparison. But it is a similar slippery slope.
        detaro 5y ago
        Amazon Sidewalk also is not "open connectivity".
      - sgtnoodle 5y ago
        I recently read up on Bluetooth low energy. The AirTags are most likely periodically broadcasting announcement packets, and folks' iPhones are passively receiving them. It therefore seems comparable to using 802.11 SSID beacons for geo-location, except that folk intentionally bought the AirTag to be position tracked. Just by modulating whether or not the AirTag is transmitting, it seems like you could communicate at a low data rate. You could even use hundreds or thousands of AirTag IDs to get a useful data rate. Just because you could do it, though, it seems like there are plenty of other more practical covert channels.
  - lxgr 5y ago
    > I don't want to give random people with random apps any amount of arbitrary bandwidth It uses a maximum of 500 megabyte per month. Regarding payload type registration – it seems like it would be pretty difficult to monitor that, given that payloads are encrypted. That actually seems more like a feature than a problem to me: If my IP address does not show up in any logs and I can't even see what's being transmitted, I really doubt there would be any liability for the user here.
    - justahuman74 5y ago
      Wait till your IP address gets banned from something for being a source of spam
      - zorked 5y ago
        Sidewalk does not allow generic access to the Internet. It connects to Sidewalk servers only. Source: https://www.amazon.com/gp/help/customer/display.html?nodeId=GRGWE27XHZPRPBGX https://www.amazon.com/gp/help/customer/display.html?nodeId=...
      - bradknowles 5y ago
        Or a crime gets committed via your IP address and you get thrown in jail for it.
    - secfirstmd 5y ago
      500 megabyte a month is a lot if you are loving in a relatively poor country.
      - cglace 5y ago
        Are people in poor countries likely to own a lot of Amazon devices?
      - lxgr 5y ago
        That's a fair point, and I do hope that regional caps will take that into consideration. Generally speaking, are volume caps on fixed line internet a thing in many countries? I'd imagine that it would be hard to use something like a smart speaker on such a tight data budget in the first place, as I can't imagine them to be very bandwidth-conscious in general (music streaming having no "low data usage" option on them usually, etc).
  - efitz 5y ago
    It would be trivial to design a protocol that allowed client side contact inspection. It would be possible to design an encrypted protocol that allowed Amazon server side content inspection.
- dreyfan 5y ago
  You mean like HolaVPN or Geosurf the “free VPN” applications that quite literally install a backdoor proxy on your phone or PC? The parent companies then sell access to the proxies running on your devices as “residential proxies” and also sell access to your browsing history?
  - CydeWeys 5y ago
    That sounds pretty close to malware to me. Are you saying they aren't?
    - dreyfan 5y ago
      I absolutely think that qualifies as malware, yes. Apps and browser extensions harvest PII all day and the owners of those platforms (apple, google, microsoft, mozilla) do absolutely nothing to prevent it.
      - texasbigdata 5y ago
        I mean, is it just the obfuscation of the privacy policy? If the user was told up front would that still make it malware?
- grishka 5y ago
  Silent auto-update would also be normally classified as a deliberate RCE vulnerability or a backdoor, but for some reason most people are okay with that.
- m463 5y ago
  What I've noticed is that the blackhat behaviors of the past have become business models. I remember when going around logging locations of wifi access points was "wardriving". Now apple and google do it as a matter of course using everyone's phones.
- kodah 5y ago
  Corporate broad spectrum wire tapping has been greenlit legally for a long time. An employer can listen to private and public communications that occur on and off of company owned resources. This includes: - emails - text messages - microphone arrays - shared networks - keyboard input - file storage - contact and communication history It's a logical next-step from there to expand these services under the guise of subscriptions. That's why you owning a device is problematic for them. That said, owning the platform is the next best thing because they can now do many but not all of those things in the name of protecting their platform from "abuse". Sources: https://www.jstor.org/stable/27673175?seq=1 https://www.jstor.org/stable/27673175?seq=1 https://www.npr.org/templates/story/story.php?storyId=123024596 https://www.npr.org/templates/story/story.php?storyId=123024...
rantwasp 5y ago
not to defend Amazon or anything, but are we sure this is actually sharing your internet connection? the way i understand it is that this would be strictly Amazon devices and strictly for control traffic (ie reboot/configure your device). It shouldn’t be possible to straight up browse the web or download whatever. I may be terribly wrong. Also, this does not excuse the fact that they made it opt out. If it was opt in and new devices came with it... maybe...
- Firerouge 5y ago
  It might just be Amazon control traffic initially, but who's to say in time someone won't publish a TCP tunnel over the Alexa protocol project on github
- thayne 5y ago
  Even if it is just control traffic, it still uses up your bandwidth, and is additional surface area for a malicious actor to attack your network.
  - rantwasp 5y ago
    i’m not advocating for it. i think it’s terrible. i’m just pointing out that maybe we are misrepresenting what this is. also, as far as illegal traffic and stuff: if the traffic goes through the amazon device, wouldn’t the isp see traffic that goes only go random amazon datacenter ? at that point they would ask amazon about it (hopefully) and do their homework.
    - KeepFlying 5y ago
      It may go through an Amazon device, but that fact is stripped away as soon as the packet leaves your network. Your router may know it came from your Echo, but your ISP won't have a clue. And even if Amazon is tunneling all traffic now, that may change or someone may find a way to break out of it. And even if law enforcement sees that the traffic is from Sidewalk, our legal system is pretty shit regarding the internet and I bet a dedicated prosecutor would try to get you for aiding a criminal because you technically allowed that access to your network. Look at the legal issues around running TOR exit nodes and the uncertainty there, in a lot of ways this is an opt-out version of that. (though I admit this might be a stretch, but I don't trust the legal system enough to handle this well).
Abishek_Muthian 5y ago
Also the devices which provide 'Amazon Alexa' as the only interface for operation.
roofwellhams 5y ago
IPhone shares data via Bluetooth. Windows shares data to download updates. I'm sure Android is similar. Samsung find my phone use network from other Samsungs nearby. I guess it's game over
lupire 5y ago
Comcast already does this. Has anyone been prosecuted for crimes using Comcast hotspots?
- asveikau 5y ago
  Do you mean the "xfinitywifi" ssid? Afaik you don't get the customer's IP address when you use that. And you definitely need to enter your Comcast credentials to use it, so law enforcement could probably trace who is really using it. They probably remember your login based on wifi MAC, so it's probably easy to fake being somebody else, however.
  - dhosek 5y ago
    They do it a bit more sophisticated than that. There's an xfinity profile that gets loaded and after the initial authentication you actually connect to a different SSID. When I had Comcast, I used this occasionally, but it was overall pretty flakey and I ended up disabling that SSID on my phone because it kept connecting to non-functioning xfinity hotspots while I was out and about and then I'd have no internet.
- thayne 5y ago
  I don't like that comcast does this without adequately informing customers. But since Comcast is the ISP, at least in theory, they can mitigate some of the concerns, like not counting the shared bandwidth against the customer's limits and not associating any criminal behavior on the shared connection with the host.
  - lgats 5y ago
    They also completely own the hardware on which this service is offered.
    - spease 5y ago
      You can buy and use your own cable modem that doesn't have a WiFi radio.
notyourwork 5y ago
You can disable this feature. Problem solved.
- heavyset_go 5y ago
  Until an update or reset switches it back on, or an app or system feature requires you to turn it on, or you buy a device and forget about it, or you're just not aware of the feature at all.
- KeepFlying 5y ago
  I can disable it this time because I got lucky and heard about it happening. There's no assurance that I'll hear about the next invasive feature, which is yet another security risk in my network that I need to be aware of.
- iso1210 5y ago
  Yes, by not connecting amazon devices to my network
beermonster 5y ago
I already give people reasons they should avoid them. Even when I tell them you have to tell Alexa to delete history at the end of the day they’re not all that concerned. Useful list of tips here : https://voicebrew.com/alexa-day-30/alexa-privacy/ https://voicebrew.com/alexa-day-30/alexa-privacy/
bradknowles 5y ago
Yup, that’s why I don’t use any Amazon devices of any type, way, shape, or form.

unyttigfjelltol 5y ago

A phone app that did this would be malware. When Alexa does it, this is a feature?

efitz 5y ago
You mean, like AirTag/Find My? I think that Amazon's marketing for this is horrible, reminds me of XBox' failed marketing around their online-only plan for XBox One game purchases [1]. But really all they've done is built AirTags as a platform rather than an application, e.g. Tile is supported by Amazon's new platform. I don't want to give random people with random apps any amount of arbitrary bandwidth; I'd rather that users of the Sidewalk platform would have to register app specific message types publicly (to ensure transparency) and with Amazon (who should enforce message type and payload restrictions). [1] https://arstechnica.com/gaming/2013/06/xbox-one-eighty-microsoft-fails-to-sell-the-future-retreats-to-the-past/ https://arstechnica.com/gaming/2013/06/xbox-one-eighty-micro...
- clajiness 5y ago
  > You mean, like AirTag/Find My? Can you explain your comparison?
  - efitz 5y ago
    Any AirTag owned by anybody can and will communicate with your iPhone over Bluetooth if you have the right features enabled (which are default). Your phone will contact Apple and tell them about the interaction. I haven’t seen protocol details, but last week a security researcher demonstrated that it is possible to use the AirTags protocol as a covert channel (with very low bandwidth).
    - bottled_poe 5y ago
      not great, but not the same as open connectivity to unknown devices.
      - SN76477 5y ago
        No, it isn’t a great comparison. But it is a similar slippery slope.
      - detaro 5y ago
        Amazon Sidewalk also is not "open connectivity".
    - sgtnoodle 5y ago
      I recently read up on Bluetooth low energy. The AirTags are most likely periodically broadcasting announcement packets, and folks' iPhones are passively receiving them. It therefore seems comparable to using 802.11 SSID beacons for geo-location, except that folk intentionally bought the AirTag to be position tracked. Just by modulating whether or not the AirTag is transmitting, it seems like you could communicate at a low data rate. You could even use hundreds or thousands of AirTag IDs to get a useful data rate. Just because you could do it, though, it seems like there are plenty of other more practical covert channels.
- lxgr 5y ago
  > I don't want to give random people with random apps any amount of arbitrary bandwidth It uses a maximum of 500 megabyte per month. Regarding payload type registration – it seems like it would be pretty difficult to monitor that, given that payloads are encrypted. That actually seems more like a feature than a problem to me: If my IP address does not show up in any logs and I can't even see what's being transmitted, I really doubt there would be any liability for the user here.
  - justahuman74 5y ago
    Wait till your IP address gets banned from something for being a source of spam
    - zorked 5y ago
      Sidewalk does not allow generic access to the Internet. It connects to Sidewalk servers only. Source: https://www.amazon.com/gp/help/customer/display.html?nodeId=GRGWE27XHZPRPBGX https://www.amazon.com/gp/help/customer/display.html?nodeId=...
    - bradknowles 5y ago
      Or a crime gets committed via your IP address and you get thrown in jail for it.
  - secfirstmd 5y ago
    500 megabyte a month is a lot if you are loving in a relatively poor country.
    - cglace 5y ago
      Are people in poor countries likely to own a lot of Amazon devices?
    - lxgr 5y ago
      That's a fair point, and I do hope that regional caps will take that into consideration. Generally speaking, are volume caps on fixed line internet a thing in many countries? I'd imagine that it would be hard to use something like a smart speaker on such a tight data budget in the first place, as I can't imagine them to be very bandwidth-conscious in general (music streaming having no "low data usage" option on them usually, etc).
- efitz 5y ago
  It would be trivial to design a protocol that allowed client side contact inspection. It would be possible to design an encrypted protocol that allowed Amazon server side content inspection.
dreyfan 5y ago
You mean like HolaVPN or Geosurf the “free VPN” applications that quite literally install a backdoor proxy on your phone or PC? The parent companies then sell access to the proxies running on your devices as “residential proxies” and also sell access to your browsing history?
- CydeWeys 5y ago
  That sounds pretty close to malware to me. Are you saying they aren't?
  - dreyfan 5y ago
    I absolutely think that qualifies as malware, yes. Apps and browser extensions harvest PII all day and the owners of those platforms (apple, google, microsoft, mozilla) do absolutely nothing to prevent it.
    - texasbigdata 5y ago
      I mean, is it just the obfuscation of the privacy policy? If the user was told up front would that still make it malware?
grishka 5y ago
Silent auto-update would also be normally classified as a deliberate RCE vulnerability or a backdoor, but for some reason most people are okay with that.
m463 5y ago
What I've noticed is that the blackhat behaviors of the past have become business models. I remember when going around logging locations of wifi access points was "wardriving". Now apple and google do it as a matter of course using everyone's phones.
kodah 5y ago
Corporate broad spectrum wire tapping has been greenlit legally for a long time. An employer can listen to private and public communications that occur on and off of company owned resources. This includes: - emails - text messages - microphone arrays - shared networks - keyboard input - file storage - contact and communication history It's a logical next-step from there to expand these services under the guise of subscriptions. That's why you owning a device is problematic for them. That said, owning the platform is the next best thing because they can now do many but not all of those things in the name of protecting their platform from "abuse". Sources: https://www.jstor.org/stable/27673175?seq=1 https://www.jstor.org/stable/27673175?seq=1 https://www.npr.org/templates/story/story.php?storyId=123024596 https://www.npr.org/templates/story/story.php?storyId=123024...

rantwasp 5y ago

not to defend Amazon or anything, but are we sure this is actually sharing your internet connection? the way i understand it is that this would be strictly Amazon devices and strictly for control traffic (ie reboot/configure your device). It shouldn’t be possible to straight up browse the web or download whatever. I may be terribly wrong. Also, this does not excuse the fact that they made it opt out. If it was opt in and new devices came with it... maybe...

Firerouge 5y ago
It might just be Amazon control traffic initially, but who's to say in time someone won't publish a TCP tunnel over the Alexa protocol project on github
thayne 5y ago
Even if it is just control traffic, it still uses up your bandwidth, and is additional surface area for a malicious actor to attack your network.
- rantwasp 5y ago
  i’m not advocating for it. i think it’s terrible. i’m just pointing out that maybe we are misrepresenting what this is. also, as far as illegal traffic and stuff: if the traffic goes through the amazon device, wouldn’t the isp see traffic that goes only go random amazon datacenter ? at that point they would ask amazon about it (hopefully) and do their homework.
  - KeepFlying 5y ago
    It may go through an Amazon device, but that fact is stripped away as soon as the packet leaves your network. Your router may know it came from your Echo, but your ISP won't have a clue. And even if Amazon is tunneling all traffic now, that may change or someone may find a way to break out of it. And even if law enforcement sees that the traffic is from Sidewalk, our legal system is pretty shit regarding the internet and I bet a dedicated prosecutor would try to get you for aiding a criminal because you technically allowed that access to your network. Look at the legal issues around running TOR exit nodes and the uncertainty there, in a lot of ways this is an opt-out version of that. (though I admit this might be a stretch, but I don't trust the legal system enough to handle this well).

Abishek_Muthian 5y ago

Also the devices which provide 'Amazon Alexa' as the only interface for operation.

roofwellhams 5y ago

IPhone shares data via Bluetooth. Windows shares data to download updates. I'm sure Android is similar. Samsung find my phone use network from other Samsungs nearby. I guess it's game over

lupire 5y ago

Comcast already does this. Has anyone been prosecuted for crimes using Comcast hotspots?

asveikau 5y ago
Do you mean the "xfinitywifi" ssid? Afaik you don't get the customer's IP address when you use that. And you definitely need to enter your Comcast credentials to use it, so law enforcement could probably trace who is really using it. They probably remember your login based on wifi MAC, so it's probably easy to fake being somebody else, however.
- dhosek 5y ago
  They do it a bit more sophisticated than that. There's an xfinity profile that gets loaded and after the initial authentication you actually connect to a different SSID. When I had Comcast, I used this occasionally, but it was overall pretty flakey and I ended up disabling that SSID on my phone because it kept connecting to non-functioning xfinity hotspots while I was out and about and then I'd have no internet.
thayne 5y ago
I don't like that comcast does this without adequately informing customers. But since Comcast is the ISP, at least in theory, they can mitigate some of the concerns, like not counting the shared bandwidth against the customer's limits and not associating any criminal behavior on the shared connection with the host.
- lgats 5y ago
  They also completely own the hardware on which this service is offered.
  - spease 5y ago
    You can buy and use your own cable modem that doesn't have a WiFi radio.

notyourwork 5y ago

You can disable this feature. Problem solved.

heavyset_go 5y ago
Until an update or reset switches it back on, or an app or system feature requires you to turn it on, or you buy a device and forget about it, or you're just not aware of the feature at all.
KeepFlying 5y ago
I can disable it this time because I got lucky and heard about it happening. There's no assurance that I'll hear about the next invasive feature, which is yet another security risk in my network that I need to be aware of.
iso1210 5y ago
Yes, by not connecting amazon devices to my network

beermonster 5y ago

I already give people reasons they should avoid them. Even when I tell them you have to tell Alexa to delete history at the end of the day they’re not all that concerned. Useful list of tips here : https://voicebrew.com/alexa-day-30/alexa-privacy/ https://voicebrew.com/alexa-day-30/alexa-privacy/

bradknowles 5y ago

Yup, that’s why I don’t use any Amazon devices of any type, way, shape, or form.