9 ms·

Ask HN: Is anyone monitoring popular apps to check if they're listening?

94 points by gitgud 5y ago

Everyone's heard the conspiracy that Facebook and Instagram record audio from your phone's microphone and use it to recommend you advertising... Is there any evidence of this? or are there any groups monitoring the appstore binaries to tell if they actually sending voice data over the wire?

mikewarot 5y ago
I have learned one thing, regardless of assumptions about if they are listening... never name your smart speaker "computer", the number of false triggers is frustrating as heck.
- fuzzfactor 5y ago
  Only Spock was allowed to do that.
diplodocusaur 5y ago
Haven't checked but couldn't you make one that does and compare data usage volume? But "listening, on everyone" and "all the time" are not necessary assumptions.
after_care 5y ago
If there was any evidence I’m sure the EFF would be talking about this. https://mobile.twitter.com/eff/status/1164331076375814144?lang=en https://mobile.twitter.com/eff/status/1164331076375814144?la...
- deepsun 5y ago
  EFF cannot monitor everything, it just protects your rights.
  - after_care 5y ago
    Sure, but if someone was monitoring and they did have evidence then the EFF would most likely publicize the findings. You can answer the question “has anyone found evidence of popular apps monitoring audio data” by searching EFF archives. It’s not exactly the same thing, but it is something of interest.
nicolaslem 5y ago
> Is there any evidence of this? There is a Reply All episode from 2017 about it. The answer was no. https://gimletmedia.com/shows/reply-all/z3hlwr https://gimletmedia.com/shows/reply-all/z3hlwr
matt123456789 5y ago
Good question. iPhones tell you when applications access the mic or camera using an indicator light along the top, and I haven’t noticed unusual hardware access patterns from any of the popular apps that I use. But like most other users, I’m not always paying attention, and I don’t keep track of every access.
PragmaticPulp 5y ago
No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could. iOS limits what apps can even do in the background and shows an icon when the microphone is in use in the background. Again, it would be obvious if apps were listening. But let’s assume that somehow they managed to avoid all of these pitfalls and they were listening to conversations, performing speech to text, and uploading your conversations. This would require communication with their servers, which isn’t difficult to extract through basic reverse engineering. Many security researchers reverse engineer these communications on a regular basis to look for bugs, some of which can be worth six figures in these companies’ bounty programs. If there was an API for uploading your secret conversations, it would be the holy grail discovery for a security researcher. Someone would have found it. The myth persists because coincidences will happen in high numbers at scale. If hundreds of millions of people are spending hours on social media each week, some number of them will see ads related to some conversation they had recently by pure random chance. Add in a general distrust for big tech companies right now and some subset of people will become convinced that their coincidences are evidence of a conspiracy.
- dylan604 5y ago
  >Recording and interpreting speech would require a lot of CPU (if done on device) Does this include the newer Apple Axx series units with increasing number of ML cores? Siri is supposed to run locally on device. Hardware is moving explicitly in this direction. If this is done locally, no actual voice data would need to be sent down the wire. Insstead, a small compressed bit of text on keywords could be sent whether that's immediately or saved up until user foregrounds the app. No tinfoil hat needed to see how your premise is pretty weak.
  - PragmaticPulp 5y ago
    > Insstead, a small compressed bit of text on keywords could be sent whether that's immediately or saved up until user foregrounds the app. Which would then appear in the packet captures that can be performed on the traffic (after circumventing certificate pinning). My premise wasn’t that each step was impossible. It was that many steps would have to take place without being detected anywhere along the chain.
smoldesu 5y ago
If this did happen, some 12-year-old with WireShark would probably make national news. In other words, Facebook and Instagram are probably 3 steps ahead of you. Whether that should scare or console us, well, that's up to you.
mritzmann 5y ago
> Is there any evidence of this? No, because this is a conspiracy. Whoever claims something like that should prove it and not the other way around.
- techbio 5y ago
  I think you mean a "false conspiracy theory", because if there actually were a conspiracy to monitor conversation through common apps, as other comments mentioned, it would have been found already.
donclark 5y ago
If they are not actually listening, has someone mapped out how I get an ad related to a verbal conversation? What did they do to put the pieces together? I would imagine several different scenarios to get an actual match - but Ive wondered this at least a couple of times (too close a coincidence that is).
- np- 5y ago
  They don’t need to listen to audio, which is very cumbersome and error prone, if they have your location. If your location is available, so are all of your friends’ locations. The apps can easily see who’s in the same place at the same time and generate a “friend” network. Presumably you talk to your friends about your thoughts, and they talk to their friends. All it takes is a few people to start googling something new (or looking up products in Amazon, or searching for the same tags on Instagram, etc etc) in this network for the algorithm to realize this might be something you’re ALL talking to each about, and thus advertise straight to you, giving the perfect illusion that whatever you’re talking about is advertised back to you.
- edent 5y ago
  It's a mixture of things. The first is "Baader–Meinhof phenomenon" / frequency bias. Your friends talk about X, all of a sudden you notice adverts about X. Of course, you discount the thousands of adverts you see which aren't about X. Why are you and your friends talking about X? Because it's a demographically popular topic. And advertisers have noticed that $gender people of $age_range in $city are searching for X. So you get an advert. You're not as unique as you think! Or, while hanging out, you're attached to the same WiFi spot. One of you does a search for X before talking about it. So the retargetting continues. The key thing is - why are you talking about what you're talking about?
  - casperc 5y ago
    Can all apps access information on the wifi hotspot that a user is connnected to? Seems like an information leak that should be closed by Apple/Google.
deleted 5y ago
[deleted]
bob229 5y ago
You don’t need to monitor the Facebook app if you just delete your account like a sensible person
_wldu 5y ago
How do Android and iOS known when you say "OK Google" or "Hey Siri" if they are not listening all the time? Or, is it accepted that they are?
- angelzen 5y ago
  They are listening all the time. Presumably 'just' for the wakeword. Better yet, Alexa listens to everything you do inside your house, and the Ring Network listens to everything you do outside your house. And both of them are connected to the power outlet, so the 'but battery depletion' excuse doesn't apply.
- justusthane 5y ago
  The listening for the initial keyword (e.g. “Hey Siri”) is done on hardware designed specifically for that purpose. That’s why you can’t change the keyword to whatever you want. Only when that keyword is heard does it actively listen to and process whatever follows. “Actively” listening all the time would simply consume too much CPU/bandwidth/battery.
  - dylan604 5y ago
    >That’s why you can’t change the keyword to whatever you want. Which I feel is a huge security oversight. You should be able to choose from a list of activation keywords at least. I love being on video/voice chats with people that I know have a device and randomly say "Alexa, play Dancing Queen" or something equally obnoxious like "Alexa, turn off lights".
  - angelzen 5y ago
    What exactly prevents the 'hardware designed specifically for that purpose' to include in its purpose the translation of your voice to text, with voice fingerprinting for good measure? Have you ran an electronic microscope atom layer slicing of the hardware to guarantee its complete set of functionalities?
    - midasuni 5y ago
deleted 5y ago
[deleted]
jpeter 5y ago
I wonder if anyone is monitoring the apps you can get on pirate bay (windows, photoshop, etc.)
- barbarelephant 5y ago
  I’m also curious about this. Would be nice to have some kind of general independent service (or wiki?) similar to consumer reports for cybersecurity.
  - reginold 5y ago
    From the discussion here, it appears that no one is monitoring broadly. The big apps (fb, insta) potentially are being checked as they have bug bounties and warrant research time. But for less popular apps, or pirated apps, it sounds like no one is checking.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
iJohnDoe 5y ago
There is so much misinformation in these comments about so many topics. It’s weird. Like bots or a hired damage control media agency that are meant to diffuse certain topics anytime they come up.
bkovacev 5y ago
I was at the Zurich airport while I had a connecting flight to Barcelona from Belgrade. My friend and I briefly spoke about Zlatibor (a city in Serbia), 30 seconds later I got an ad for a hotel in Zlatibor, in the middle of Zurich Airport. We never spoke about or searched for Zlatibor.

NikolaNovak 5y ago

"Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth" It was my understanding that typically phone voice audio quality is a few kilo bits per second - not much more than a kilobyte per second. This would get positively lost in the noise of modern smartphone constant background connectivity, no? (largely agree with your other points, though my understanding of original post was question for specifics on who actually may be checking these things rather than "somebody surely would've caught it")

PragmaticPulp 5y ago
> This would get positively lost in the noise of modern smartphone constant background connectivity, no? If you’re only looking at total up/down traffic for the entire device, it might. But we can inspect traffic per-app, including decoding the actual traffic (if you go through steps to circumvent certificate pinning). Security researchers can, and do, look at the actual raw data coming out of apps. If voice was in there, it would be seen.
- angelzen 5y ago
  Average person speaks 16k words per day. Android considers app background traffic excessive at 50MB / hour, which is 1GB / day. 10% of that rate to steer clear of raising red flags is 100MB / day, about 10kB for each word you speak. Rather trivial to steganograph a word in 10kB of background traffic. https://www.scientificamerican.com/article/women-talk-more-than-men https://www.scientificamerican.com/article/women-talk-more-t... https://developer.android.com/topic/performance/vitals/bg-network-usage https://developer.android.com/topic/performance/vitals/bg-ne...
  - fsociety 5y ago
    You have to calculate the amount of data provided from all users in this case + storage + processing power to do all of that. It’s probably more than you would expect too. The second point is why would a company do that? If the NSA or whomever wants to snoop on you, they’ll drop malware on your phone, subpoena your iCloud backups etc. not try to coerce a company to record people’s conversations when said company has no desire to do so.
- reginold 5y ago
  Any insight into how this was uncovered? A sports league secretly used their Android app's microphone to uncover illegal broadcasts. https://www.techrepublic.com/article/laliga-facing-eur250k-fine-for-gdpr-violations-in-app-used-to-spy-on-users/ https://www.techrepublic.com/article/laliga-facing-eur250k-f... Edit: I was wrong, they were upfront with people about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-app-uses-surveillance-on-its-own-users-to-fight-piracy/ https://www.techrepublic.com/article/how-one-spanish-soccer-...)
  - PragmaticPulp 5y ago
    Fourth paragraph of the article explains it: > This functionality is not happening surreptitiously, as the app requests access to the microphone and geolocation service—it does not rely on a vulnerability to access these components without explicit permission Users had to have the app open and grant the permission. They weren’t recording secretly in the background.
    - reginold 5y ago
      edit: ah yes, I was wrong here, they were disclosing Here's a better article on this: https://www.techrepublic.com/article/how-one-spanish-soccer-app-uses-surveillance-on-its-own-users-to-fight-piracy/ https://www.techrepublic.com/article/how-one-spanish-soccer-...
  - detaro 5y ago
    there wasn't anything to "discover", the app literally was telling users that was what it was doing.
    - reginold 5y ago
      edit: I was wrong, they were pretty up front with users about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-app-uses-surveillance-on-its-own-users-to-fight-piracy/ https://www.techrepublic.com/article/how-one-spanish-soccer-...) From the article: "Despite this, users were not explicitly informed of the intended use of the microphone and geolocation permissions, which is central to the decision by AEPD to levy fines against LaLiga." Sounds like they were spying while using microphone permissions, which is what the discussion is about.

angelzen 5y ago
The hardware runs an algorithm to detect the wakeword. What makes you confident that a different algorithm can't be run to translate voice to text? They will be in the same family of algorithms, just with different purposes. To make it more interesting, let's assume that 2021 algorithms can't do that. Will better low power algorithms be developed in the next 20 years? How is a democratic society supposed to work when would-be-snitches are ubiquitously deployed? To make it even more interesting, as more an more of our communications move to the internet (oooOOOooo, covid, cower in fear), what confidence you have that voice2text and voice fingerprinting does not already apply to all your phone/Zoom conversations? Do you run the phone/Zoom servers and monitor all potentially suspicious traffic? Have you heard of one Edward Snowden?
- kempbellt 5y ago
  When you train your phone to understand "Hey Siri" it requires an internet connection for the training so that it can verify that you are actually saying, "Hey Siri" and not "Yo, phone spirit". After the initial training, it no longer requires (or uses) the internet to detect the keyphrase. You are asked to do a few iterations of training so that the phone has a model on your voiceprint for "Hey Siri". Which is why, when someone who does not have a similar voice to you says "Hey Siri" it does not trigger. But someone who does have a similar voice to you can sometimes trigger it. The model is super basic. The microphone is always passively passing input data to the "Hey Siri" detector (and a buffer), which acts as a sort of internal switch. If it detects the trigger phrase, it then sends the audio data to the cloud to be transcribed, and acted upon accordingly. It is not always sending voice data to the cloud. If it were, your battery life would be noticeably impacted - worse than being on a phone call.
  - angelzen 5y ago
    Good explanation, thanks. The scenario is 'translate on device, steganograph the output on background traffic'. There is a huge push for 'on device ML', driven by noble intentions of hiding raw data from Skynet. Alas, the end of that road is devices that compress the raw sensorial input and report, possibly stealthily, the digest to Skynet.
  - TeMPOraL 5y ago
    This explanation does not explain why neither Google nor Apple allow you to change the wake word. Myself, I believe any technical reason, if it actually exists, is a secondary factor - the primary reason is branding. They don't want people changing wakewords, because as long as everyone uses the same, "Ok Google" and "Siri" are terms/brands.
    - kempbellt 5y ago
      To my understanding, there is no technical reason behind not being able to use custom wakewords besides them just not wanting you to. I also believe it is restricted mainly for branding and easy marketing.