Hacker News Search

colordrops 5y ago

This is a terrible suggestion. "Taking Apple's word on it" is not a valid privacy strategy. Companies have shown time and again that they lie about what is happening behind the scenes, or even just change their policies for the worst. Then there are rogue employees, such as the Ubiquiti fiasco, and secret government data collection, such as PRISM, of which Apple was a participant. Apple has broken trust multiple times, including the FBI back door, and the CSAM fiasco. They are a public company beholden to shareholders, not your trusted friend from college. Even China has strong leverage over them due to their manufacturing and market there. They are fundamentally no different from Amazon. The poster is asking for a private solution this is emphatically not it.

raffraffraff 5y ago
Honestly, I find it amazing that so many people let these things into their homes. The price you pay for such little actual utility isn't worth it. I won't use voice recognition on a single device. Not only do I not trust Google/Amazon, I don't trust that I wouldn't accidentally say something that triggers it to phone a person I'm talking about, or order something expensive in the internet. Home Assistant on my phone and lots of physical zigbee controllers works just fine for me. I don't want to talk to my devices. I have an in-law who uses voice recognition to dictate messages into WhatsApp extended family group and some of the shit she's posted is hilariously (unintentionally) spicy. Her kids get into stupid "conversations" with Alexa. They're 8. Just no.
- sneak 5y ago
  Most people believe that they have nothing to hide. To them, there is no cost in lost privacy because they do not value privacy. The sad part is, for most people who say this, it's true. Their lives indeed contain nothing interesting enough to be worth concealing.
  - beardyw 5y ago
    Saddest thought of the day.
  - genocidicbunny 5y ago
    When I'm feeling spicy, my response to that line of thinking is to ask that person for their house keys so I can come by sometime and look around. Or I'll ask them to unlock their phone so I can rummage around in their messages and photos.
    - sneak 5y ago
      I know a fair number of people who would not object. The majority of people on Earth have pretty boring lives.
      - genocidicbunny 5y ago
        Then I hold out my hand expectedly awaiting their house keys and phone.
- Tempest1981 5y ago
  Does anyone's employer have rules about having company meetings (at home) with such devices nearby? Seems potentially risky.
  - andylynch 5y ago
    Yes - in fact some firms are recommending they be disabled altogether near work areas, including at home.
  - White_Wolf 5y ago
    Yes. Had them since WHF first started. We have different rules depending on the level of the meeting though. 40-50% of the meetings are low risk and they don't require removal or power off and these devices though. For medium risk or higher we run random tests during meetings to see if they have google and alexa around. Nothing fancy or anyting. We just have they devices play a song like "Never Gonna Give You Up".
  - toomuchtodo 5y ago
    We configured endpoint detection tools (ie Very Popular Endpoint Product) to scan local networks for these devices based on open ports and mac addresses. It is fairly straightforward to fingerprint them. Not foolproof (wifi isolation and other network segmentation), but low hanging fruit.
- tpxl 5y ago
  > I don't trust that I wouldn't accidentally say something that triggers it to phone a person I'm talking about Someone set their name on Xbox live to something like "XBox turn off" then got people to read his name, which would turn off their console. It's a harmless example, but it shows that people and devices are susceptible to this kind of attack.
  - michaelrpeskin 5y ago
    Just like in the '90s we (silly script kiddies) put press "Alt-F4 to continue" on our websites.
- foobarian 5y ago
  > The price you pay for such little actual utility isn't worth it. It is for us. The use case that sold us is my partner cooks a lot and often needs to add reminders or update a shopping list, which is difficult with both hands dripping with raw chicken juice or dough or whatever. They were for sale a while ago for $30 a device and they are decent speakers to boot, better even than a $1k phone.
  - raffraffraff 5y ago
    My wife and I cook every day, and at the moment we're both using Nutracheck (so we're scanning barcodes and entering weights a lot as we cook). While I occasionally have to wipe my hands on a paper towel, I don't find myself incapacitated by sauce much of the time.
- thrashh 5y ago
  I’m not worried about my Google Home devices They’d have to work reliably first
tinus_hn 5y ago
Depending on your jurisdiction you might be able to successfully sue people who listen in on yo ur private conversations without you being aware.

BiteCode_dev 5y ago

Well you installed an always on microphone in your house, attached to a processing unit connected to internet all the time. People said again and again it's going to be abused, and you had the technical knowledge to evaluate the risk. Yet you went with it. If it was not your scenario, it would have been another one. There will be other ones. Hell, with things like PRISM, that's inviting 3 letters agencies in your bedrooms. Since the pandora box is opened and people are going to do it anyway, we should at least militate for having hardware switches on any sensors for any device.

dorgo 5y ago
>Well you installed an always on microphone in your house, attached to a processing unit connected to internet all the time. How is it different from a smartphone or notebook?
- philwelch 5y ago
  You can put them in the freezer like Edward Snowden.
- BiteCode_dev 5y ago
  Intent. I don't have my phone expecting it to listen to all the room, all the time. It could, but if it is, it's not a deliberate choice. The microphone is not made of this, I regularly put it in plane mode, I don't have an account linked to the phone nor smart assistant actives. Listening to my phone all the time would require targetting, since it's not, unlike alexa, doing so by design: https://eu.usatoday.com/story/tech/conferences/2020/02/25/google-alexa-siri-randomly-answer-even-without-wake-word-study-says/4833560002/ https://eu.usatoday.com/story/tech/conferences/2020/02/25/go...
lcvw 5y ago
The Alexas were for my elderly mother in law. If she fell or was having some sort of problem, she could call us with just her voice. Also she and my partner both like the convenience, so who am I to say that they shouldn’t have such a device? The device does have hardware switches for the camera (it was off) and the microphone but you can’t switch off the microphone without effectively disabling the device. When I she bought these devices they didn’t have this feature. None of us knew that the feature was deployed and enabled by default. To your point, it is a huge issue that we have no control over these devices anymore since the software can be changed at any time and can lie to you (lies of omission usually). The Alexa goes above and beyond imo because when this person gained access to my mother in law’s other accounts, it took about 30 minutes to permanently lock him out, despite him bypassing text based tfa by having compromised her phone. Alexa wouldn’t even tell me this problem existed, and I can’t document what happened unlike with literally every other service.

ivanhoe 5y ago
When I researched ReSpeaker was one of the better solutions, they provide various mic-array PiHats, as well as professionally looking cases for the device. They also sell pre-build devices I think, if you're not into DIY. https://www.seeedstudio.com/category/Speech-Recognition-c-44.html https://www.seeedstudio.com/category/Speech-Recognition-c-44... (Just to male it clear, I'm not affiliated with them in any way)
- Semaphor 5y ago
  Yeah, ReSpeaker looks like they have the best hardware for this. But the issue was, that they only sell one case, for their old array, which is barely available any more (neither case, nor array. But! Now they sell the new array as USB array in a proper case! That’s not perfect as I’ll have 2 devices instead of one to place/hide, but it’s still a lot better than last time I checked their site. Thank you, now I have plans for 2022 :) Hah, and of course there is only one left in stock :/ edit: And I found a company in Germany that not only resells them for almost the same price, they even have a lot of stock.
  - Cu3PO42 5y ago
    Would you mind sharing said company? If you'd rather not do so publicly, you can reach me at <myusername>@outlook.com
    - Semaphor 5y ago
      https://www.distrelec.de/de/usb-mikrofonarray-respeaker-seeed-studio-107990193/p/30164996 https://www.distrelec.de/de/usb-mikrofonarray-respeaker-seee... Note that I did not look into them, just found them when searching and bookmarked the site for next year ;)
tzs 5y ago
How about putting a string of microphones around the room, say at the top walls? You can get I2S microphones (here's a breakout for one [1]), so you'd just need a bundle of 6 wires running around the room. That breakout is $6.95 with price breaks to $6.26 at 10 and $5.56 at 100 which is probably a bit pricey for this application, but really you only need the breakout to make it easy to play around with it on a breadboard. The other parts on the breakout besides the microphone module itself are just a couple of resistors. The module itself looks like it would be reasonable to solder wires directly onto, so you should be able to build a microphone string with just the microphone modules, the wire, and a couple of axial resistors at each microphone. Here's that particular microphone module at Mouser [2]. $2.64 for one, price breaks to $2.19 at 10, $2.02 at 25, $1.90 at 50, and $1.78 at 100. There are other I2S and I2C and SPI microphones. The SPH0645 just happened to be the first one I found to use as an example. I'm not sure though if any of these interfaces have enough bandwidth to support enough microphones simultaneously for this to work. You might need multiple parallel strings, or maybe a hierarchical system, like having some ESP32 modules on the walls too, with each ESP32 handling a smaller string of microphones, and the EPS32s reporting what they hear along with timing data wirelessly to whatever is doing the processing. [1] https://www.adafruit.com/product/3421 https://www.adafruit.com/product/3421 [2] https://www.mouser.com/ProductDetail/Knowles/SPH0645LM4H-B?qs=sGAEpiMZZMua3V2yDfsb6XDjI0CVtkYErfZfmVpe%2FpQ%3D https://www.mouser.com/ProductDetail/Knowles/SPH0645LM4H-B?q...
- Semaphor 5y ago
  I love the idea. Somewhat impractical for renting, and it both requires more skills and even more effort. But it sounds like a cool project I’d love reading about in a blog :D
- 2Gkashmiri 5y ago
  you mean like those string led lights? how about adding the microphones to the same strip for power and then an attached esp32 for data to a central one? that sounds nice
GhettoComputers 5y ago
Can you use an Alexa and gut it while replacing the controller? I don’t know how it mixes the mics but you can have your case and array, hopefully the hardware isn’t dependent on the processor. What about a controller you carry around with you that you can speak into, like phone software, a watch, or if you’re into the hacker chic look, a mounted mic you wear? I don’t think speaking is even the best choice, it’s limiting, a phone can be a web interface, gestures over a sensor seems reasonable for basic controls and speech to text can be piped into it as commands though your phone you carry with you anyway. If you’re controlling lights it’s less hassle though a GUI, and limiting it to voice will not make your life easier.

dsomers 5y ago
> There are types of hashes that aren’t for finding exact matches. My thesis in school way back when was building something for image near-duplicate detection using a sort of hash made out of the image features detected. The output of a neural net run on an image is also a sort of hash in a (maybe) semantically meaningful vector space. And then you can look for similar or nearby vectors. This isn’t just useful for finding one type of image. What's the point you're trying to get at here. I think it's well understood that there can be false positives -- but can you tell me at what rate of false positives it makes this type of child abuse detection unjustified? Also can you tell me what rate Apples system would cause a false positive. If for every one billion people(hypothetically of course) that are caught with child abuse images, one innocent person is asked to unlock their phone to prove that it's a false positive to a court, I think that's a fine trade off to make. I understand it's unpleasant for that one person, but I don't think you're correctly weighing the suffering to children this could help stop. > It’s because it makes it easy to create a population-wide dragnet for other things. It’s not hard to apply something similar to find photos taken at a protest, for example. This is in my opinion where thinking of people on your side is wrong and fundamentally dealing with these hard and nuanced issues on the wrong conceptual level. If the government wants to create a population-wide dragnet there are a lot of other ways to also do that. If for example an iPhone was a literal perfect privacy machine it would simply be forbidden from being sold in totalitarian countries that wanted that type of dragnet. The thing that you're fundamentally missing the point on, in my opinion, is that the thing that protects me is not the technology, it's that I live in a democratic country that has laws to stop such thing as being prosecuted for just attending a protest. The police can listen to my phone calls and read my mail _right now_ but what keeps that kind of thing from being used against me in an unfair way are the courts. Fundamentally I don't think any technological solution can save any of us if we live under a totalitarian government.
- smoldesu 5y ago
  Boy, there's a number of misconceptions here. I was considering not responding, but you're so wrong here that I just can't walk away and let you continue to spread this kind of blatantly wrong handwaving. > If for every one billion people(hypothetically of course) that are caught with child abuse images, one innocent person is asked to unlock their phone to prove that it's a false positive to a court, I think that's a fine trade off to make. How do you know the false positive rate yet? Not only has Apple not implemented it yet, but people have shown that a. NeuralHash can correlate two completely unrelated, undoctored images b. Hash collisions are be manually designed with minimal effort and changes to the source image You're pulling this hypothetical figure out of thin air, it may as well be one in a hundred or one in a trillion. > I don't think you're correctly weighing the suffering to children this could help stop. That's not the problem here. If people want to continue to store photos of child exploitation on their iPhone, they can do it with the flip of a switch. Once you disable iCloud, Apple stops client-side scanning altogether. That arguement is a whole lot of bark with no bite, and unless Apple did the unthinkable (eg. store hashes for every photo you ever took regardless of it's status on iCloud), it's never going to hold water. > If the government wants to create a population-wide dragnet there are a lot of other ways to also do that. Oh, like they already[0] do[1]? iMessage has been wiretapped since 2013, it's an open secret at this point that Apple is deep in bed with domestic intelligence agencies. Denying this is just refusing to acknowledge a truth that has reared it's ugly head again and again and again. > If for example an iPhone was a literal perfect privacy machine it would simply be forbidden from being sold in totalitarian countries that wanted that type of dragnet. Countries like China, who demanded that Apple give them complete control over their domestic data[2], a request that Apple happily complied with? If they give foreign markets complete control over iPhone data in their respective countries, imagine for a moment how trustworthy their behavior is in the United States, the same country that decides if they're a monopoly or not and sets their tax rates. > the thing that protects me is not the technology, it's that I live in a democratic country that has laws to stop such thing as being prosecuted for just attending a protest If you think that's what they care about then you're missing the point entirely too. People aren't paranoid that they're going to be thrown in jail for legal action, that's frankly silly. What the United States wants is two things: your trust and your data. They could care less if you're cooking drugs on your property, selling weapons illegally or, in many cases, exploiting children. If they actually cared about those things, they'd divert some of the national budget to addressing those issues. Instead, they take that money and invest it in surveillance. Billions of dollars get poured into black budgets every year, with margins that constantly expand. The NSA regularly backdoors encryption standards, the FBI regularly designs exploits and incorporates them into US infrastructure. If any of our surveillance programs want to backdoor an iPhone or introduce vulnerabilities into iPhones, Apple has no recourse. > The police can listen to my phone calls and read my mail _right now_ but what keeps that kind of thing from being used against me in an unfair way are the courts. What keeps them from doing that is that it's a pointless, fruitless endeavor to try and criminalize their entire nation. It wouldn't be hard to arrest the majority of US Citizens, it would just be expensive and time-consuming. A much more appealing effort is to keep tabs on everything you do, everywhere you go and everyone you talk to. That way, if you become a legitimate threat to the state they can zero you before you cause any real damage. Make no mistake, every government is only out to save their own skin. You may disagree with it, or find it silly, but that's realpolitik for you. > Fundamentally I don't think any technological solution can save any of us if we live under a totalitarian government. Finally, your first reasonable argument (and it's a concession to the point the other commenter was making in the first place). There is no way that we're living in a world where our government lacks the competence or resources to effectively monitor us at every corner. The reason why this concerns people is that it allows governments to collect data on what kinds of photos their population has saved/synced with the cloud. Apple is given a black-box list of irreversible image signatures that the government themselves consider harmful, and there is literally zero transparency that goes into this process. We have quite literally no idea how any of this works, and have no way to verify that it isn't being abused. Your trust in Apple and the US Government has to be unreasonably high to confidently say that this won't be abused in some way. [0] https://reason.com/2021/12/07/secret-documents-show-which-message-apps-are-the-most-fbi-proof/ https://reason.com/2021/12/07/secret-documents-show-which-me... [1] https://arstechnica.com/gadgets/2012/04/apple-holds-the-master-key-when-it-comes-to-icloud-security-privacy/ https://arstechnica.com/gadgets/2012/04/apple-holds-the-mast... [2] https://www.reuters.com/article/us-china-apple-icloud-insight-idUSKCN1G8060 https://www.reuters.com/article/us-china-apple-icloud-insigh...
  - dsomers 5y ago
    >You're pulling this hypothetical figure out of thin air, it may as well be one in a hundred or one in a trillion. I agree, but it’s just as had waving when I say maybe it’s low chance that there are false positives, as it is when you’re freaking out at it being a hypothetically high number of false positives. > That's not the problem here. If people want to continue to store photos of child exploitation on their iPhone, they can do it with the flip of a switch. Once you disable iCloud, Apple stops client-side scanning altogether. If it’s so much under the users control why do you care or feel like this is an invasion of privacy then? I’ll say I feel like it’s still useful because criminals make dumb mistakes that incriminate themselves all the time — and this is a fine balance between being overly invasive and catching some people that store abuse images. > Oh, like they already[0] do[1]? iMessage has been wiretapped since 2013, it's an open secret at this point that Apple is deep in bed with domestic intelligence agencies. Denying this is just refusing to acknowledge a truth that has reared it's ugly head again and again and again. Yes, everyone knows this stuff, but just because it’s happening does not mean it can be used to incriminate someone in court unless there is justified prior suspicion which a judge issues a warrant for. That’s where the transparency is, at the court level. > Countries like China… This is a silly example, it makes me sad to say, but people in China are going to have their personal freedoms violated in very harsh ways regardless of Apple operating there of not. Unfortunately that’s the reality of living under totalitarianism — I don’t know why you’d even bring this up when I am clearly stating that what really protects people is living in a free democratic country with a well functioning court system. > If they actually cared about those things, they'd divert some of the national budget to addressing those issues. Instead, they take that money and invest it in surveillance. Billions of dollars get poured into black budgets every year, with margins that constantly expand. The NSA regularly backdoors encryption standards, the FBI regularly designs exploits and incorporates them into US infrastructure. I don’t wholly disagree, but I don’t see the connection with the original point. Also, you’re talking about governments as a monolith, which is a mistake. Any government is made of may departments and people, when you say ‘if they actually cared’, who’s the ‘they’? I think it’s really silly to say no-one in any part of the FBI cares about stoping child abuse for example. Sure I get that the CIA does not care, but that’s just not their job either. > If any of our surveillance programs want to backdoor an iPhone or introduce vulnerabilities into iPhones, Apple has no recourse. Maybe, maybe not. What is your hypothetical scenario for this? Can you explain how you think they’d do this where Apple has no recourse? Also who is the ‘they’? When you just say ‘they’ in a handwaving general way you sound conspiratorial. Are you saying they’d do it and apple could not detect it? Or that they’d coerce apple and apple would have no legal way to stop them? > A much more appealing effort is to keep tabs on everything you do, everywhere you go and everyone you talk to. That way, if you become a legitimate threat to the state they can zero you before you cause any real damage. Make no mistake, every government is only out to save their own skin. You may disagree with it, or find it silly, but that's realpolitik for you. This is where we depart the most. I’m European, In my opinion, America, with its two party non proportional system is a very poor example of democracy that is quite susceptible it corruption because of it’s concentration of powers. Just because you guys don’t live in a well functioning democracy does not mean that’s the case for the whole world — you’re projecting a bit here. I guess we agree in our mistrust of the US. Hopefully you guys don’t slid more on that totalitarian scale even more I guess. > There is no way that we're living in a world where our government lacks the competence or resources to effectively monitor us at every corner. I guess you don’t know about off grid log cabins that have no cell signal ;-) > Apple is given a black-box list of irreversible image signatures that the government themselves consider harmful, and there is literally zero transparency that goes into this process. We have quite literally no idea how any of this works, I think this is the point you’re wrong here, if there is a false positive I believe even in the US that you’ll be able to simply exhibit the source image that caused the false positive in court, if it even gets that far, which I think probably not, and prove innocence. The hash match is not the proof that you have child abuse images — it just starts a process of review. I think in practice it’ll start a process where a manual review will happen where someone will look at your source image and say, oh yeah, that’s clearly a false positive, and then it’s done. I’m sure we’ll know more where the first people get cause with this mechanism because it will still have to be prosecuted in a public court and at that time we won’t have to speculate so much.