3 ms·

"Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth" It was my understanding that typically phone voice audi

"Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth" It was my understanding that typically phone voice audio quality is a few kilo bits per second - not much more than a kilobyte per second. This would get positively lost in the noise of modern smartphone constant background connectivity, no? (largely agree with your other points, though my understanding of original post was question for specifics on who actually may be checking these things rather than "somebody surely would've caught it")

PragmaticPulp 5y ago
> This would get positively lost in the noise of modern smartphone constant background connectivity, no? If you’re only looking at total up/down traffic for the entire device, it might. But we can inspect traffic per-app, including decoding the actual traffic (if you go through steps to circumvent certificate pinning). Security researchers can, and do, look at the actual raw data coming out of apps. If voice was in there, it would be seen.
- angelzen 5y ago
  Average person speaks 16k words per day. Android considers app background traffic excessive at 50MB / hour, which is 1GB / day. 10% of that rate to steer clear of raising red flags is 100MB / day, about 10kB for each word you speak. Rather trivial to steganograph a word in 10kB of background traffic. https://www.scientificamerican.com/article/women-talk-more-than-men https://www.scientificamerican.com/article/women-talk-more-t... https://developer.android.com/topic/performance/vitals/bg-network-usage https://developer.android.com/topic/performance/vitals/bg-ne...
  - fsociety 5y ago
    You have to calculate the amount of data provided from all users in this case + storage + processing power to do all of that. It’s probably more than you would expect too. The second point is why would a company do that? If the NSA or whomever wants to snoop on you, they’ll drop malware on your phone, subpoena your iCloud backups etc. not try to coerce a company to record people’s conversations when said company has no desire to do so.
- reginold 5y ago
  Any insight into how this was uncovered? A sports league secretly used their Android app's microphone to uncover illegal broadcasts. https://www.techrepublic.com/article/laliga-facing-eur250k-fine-for-gdpr-violations-in-app-used-to-spy-on-users/ https://www.techrepublic.com/article/laliga-facing-eur250k-f... Edit: I was wrong, they were upfront with people about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-app-uses-surveillance-on-its-own-users-to-fight-piracy/ https://www.techrepublic.com/article/how-one-spanish-soccer-...)
  - PragmaticPulp 5y ago
    Fourth paragraph of the article explains it: > This functionality is not happening surreptitiously, as the app requests access to the microphone and geolocation service—it does not rely on a vulnerability to access these components without explicit permission Users had to have the app open and grant the permission. They weren’t recording secretly in the background.
    - reginold 5y ago
      edit: ah yes, I was wrong here, they were disclosing Here's a better article on this: https://www.techrepublic.com/article/how-one-spanish-soccer-app-uses-surveillance-on-its-own-users-to-fight-piracy/ https://www.techrepublic.com/article/how-one-spanish-soccer-...
  - detaro 5y ago
    there wasn't anything to "discover", the app literally was telling users that was what it was doing.
    - reginold 5y ago
      edit: I was wrong, they were pretty up front with users about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-app-uses-surveillance-on-its-own-users-to-fight-piracy/ https://www.techrepublic.com/article/how-one-spanish-soccer-...) From the article: "Despite this, users were not explicitly informed of the intended use of the microphone and geolocation permissions, which is central to the decision by AEPD to levy fines against LaLiga." Sounds like they were spying while using microphone permissions, which is what the discussion is about.

PragmaticPulp 5y ago

> This would get positively lost in the noise of modern smartphone constant background connectivity, no? If you’re only looking at total up/down traffic for the entire device, it might. But we can inspect traffic per-app, including decoding the actual traffic (if you go through steps to circumvent certificate pinning). Security researchers can, and do, look at the actual raw data coming out of apps. If voice was in there, it would be seen.

angelzen 5y ago
Average person speaks 16k words per day. Android considers app background traffic excessive at 50MB / hour, which is 1GB / day. 10% of that rate to steer clear of raising red flags is 100MB / day, about 10kB for each word you speak. Rather trivial to steganograph a word in 10kB of background traffic. https://www.scientificamerican.com/article/women-talk-more-than-men https://www.scientificamerican.com/article/women-talk-more-t... https://developer.android.com/topic/performance/vitals/bg-network-usage https://developer.android.com/topic/performance/vitals/bg-ne...
- fsociety 5y ago
  You have to calculate the amount of data provided from all users in this case + storage + processing power to do all of that. It’s probably more than you would expect too. The second point is why would a company do that? If the NSA or whomever wants to snoop on you, they’ll drop malware on your phone, subpoena your iCloud backups etc. not try to coerce a company to record people’s conversations when said company has no desire to do so.
reginold 5y ago
Any insight into how this was uncovered? A sports league secretly used their Android app's microphone to uncover illegal broadcasts. https://www.techrepublic.com/article/laliga-facing-eur250k-fine-for-gdpr-violations-in-app-used-to-spy-on-users/ https://www.techrepublic.com/article/laliga-facing-eur250k-f... Edit: I was wrong, they were upfront with people about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-app-uses-surveillance-on-its-own-users-to-fight-piracy/ https://www.techrepublic.com/article/how-one-spanish-soccer-...)
- PragmaticPulp 5y ago
  Fourth paragraph of the article explains it: > This functionality is not happening surreptitiously, as the app requests access to the microphone and geolocation service—it does not rely on a vulnerability to access these components without explicit permission Users had to have the app open and grant the permission. They weren’t recording secretly in the background.
  - reginold 5y ago
    edit: ah yes, I was wrong here, they were disclosing Here's a better article on this: https://www.techrepublic.com/article/how-one-spanish-soccer-app-uses-surveillance-on-its-own-users-to-fight-piracy/ https://www.techrepublic.com/article/how-one-spanish-soccer-...
- detaro 5y ago
  there wasn't anything to "discover", the app literally was telling users that was what it was doing.
  - reginold 5y ago
    edit: I was wrong, they were pretty up front with users about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-app-uses-surveillance-on-its-own-users-to-fight-piracy/ https://www.techrepublic.com/article/how-one-spanish-soccer-...) From the article: "Despite this, users were not explicitly informed of the intended use of the microphone and geolocation permissions, which is central to the decision by AEPD to levy fines against LaLiga." Sounds like they were spying while using microphone permissions, which is what the discussion is about.