6 ms·

I’m also very interested in an answer. We use Alexa a lot, but this week I had to unplug every Alexa in the house because a distant family member had gained acc

by lcvw 5y ago

I’m also very interested in an answer. We use Alexa a lot, but this week I had to unplug every Alexa in the house because a distant family member had gained access to the family Amazon account and was trying to use the “drop in” feature to listen to our conversations. In the course of our investigation I found out that Alexa does not log privacy related events at all (there is no record of a drop in stored anywhere), and the UI for locking down which profiles and contacts have access to which feature is unbelievably bad. At this point I can’t prove that this person doesn’t still have access somehow (every single contact taken from your phone has unique permissions to drop in) and I can’t delete the profile this person created without contacting customer support. So the devices are going to stay unplugged until I have time to nuke the Amazon account and create a new one. To be clear, I’m not concerned about cloud processing or even mining my data. Just something I can have a reasonable amount of control over and that doesn’t constantly enable features I don’t want on its own.

jvolkman 5y ago
What a bizarre situation. For what it's worth, Google Homes don't have this drop-in feature. You can make calls and make announcements, but both require the person on the other end to actively answer or respond.
mensetmanusman 5y ago
That deserves its own post. This reminds me of when Samsung sent the press release that people shouldn’t discuss personal things near their television, because an unpatchable product of their allowed anyone who knew how to tap into the tv mics…
- mcv 5y ago
  I have always assumed my Samsung TV didn't have a mic. How can I check if it does? I don't really want any mic-using devices that I can't control, although I suppose that ship already sailed when smartphones were introduced.
- lcvw 5y ago
  It was truly a bizarre experience. First we noticed a random intermittent ringing noise in the house and couldn’t figure out what it was. We tracked it down to the Alexa but since there are no logs or notifications we didn’t know what had just happened. It seems the person hung up when they heard us looking around so we never saw any visible indication that anything was happening. Once we figured it out, we then had to spend half a day going through the Alexa documentation (useless) and random threads on Reddit to figure out how the access control for this feature and Alexa in general works. Like I said, certain changes to your account cannot be made without contacting support and being escalated to a certain team. By the end of it I still could not be certain we had locked this person out because of the number of changes they had made to the account and how much of a mess the app is. The thing I really don’t understand is that this feature has been deployed for over a year and has received negative attention in the press. It’s just unbelievable that they would ship a feature that can turn your Alexa into a listening device and not think through what could go wrong, and never revisit it in a year.
  - raffraffraff 5y ago
    Honestly, I find it amazing that so many people let these things into their homes. The price you pay for such little actual utility isn't worth it. I won't use voice recognition on a single device. Not only do I not trust Google/Amazon, I don't trust that I wouldn't accidentally say something that triggers it to phone a person I'm talking about, or order something expensive in the internet. Home Assistant on my phone and lots of physical zigbee controllers works just fine for me. I don't want to talk to my devices. I have an in-law who uses voice recognition to dictate messages into WhatsApp extended family group and some of the shit she's posted is hilariously (unintentionally) spicy. Her kids get into stupid "conversations" with Alexa. They're 8. Just no.
    - sneak 5y ago
      Most people believe that they have nothing to hide. To them, there is no cost in lost privacy because they do not value privacy. The sad part is, for most people who say this, it's true. Their lives indeed contain nothing interesting enough to be worth concealing.
- kkjjkgjjgg 5y ago
  Why does a TV even have mics. Crazy world.
  - maccard 5y ago
    Because all of the high end TVs contain alexa/google home integrations.
    - wccrawford 5y ago
      Or even just their own search-by-voice functionality, which is useful to many people, especially those with disabilities.
      - maccard 5y ago
        That's a fair point. Samsung and LG both have their own smart integrations too in the form of iQ and Bixby.
- detaro 5y ago
  > This reminds me of when Samsung sent the press release that people shouldn’t discuss personal things near their television, because an unpatchable product of their allowed anyone who knew how to tap into the tv mics… Do you have a link for that one?
  - cassianoleal 5y ago
    I imagine they mean this. https://www.cnet.com/tech/services-and-software/samsungs-warning-our-smart-tvs-record-your-living-room-chatter/ https://www.cnet.com/tech/services-and-software/samsungs-war...
BiteCode_dev 5y ago
Well you installed an always on microphone in your house, attached to a processing unit connected to internet all the time. People said again and again it's going to be abused, and you had the technical knowledge to evaluate the risk. Yet you went with it. If it was not your scenario, it would have been another one. There will be other ones. Hell, with things like PRISM, that's inviting 3 letters agencies in your bedrooms. Since the pandora box is opened and people are going to do it anyway, we should at least militate for having hardware switches on any sensors for any device.
- dorgo 5y ago
  >Well you installed an always on microphone in your house, attached to a processing unit connected to internet all the time. How is it different from a smartphone or notebook?
  - philwelch 5y ago
    You can put them in the freezer like Edward Snowden.
  - BiteCode_dev 5y ago
    Intent. I don't have my phone expecting it to listen to all the room, all the time. It could, but if it is, it's not a deliberate choice. The microphone is not made of this, I regularly put it in plane mode, I don't have an account linked to the phone nor smart assistant actives. Listening to my phone all the time would require targetting, since it's not, unlike alexa, doing so by design: https://eu.usatoday.com/story/tech/conferences/2020/02/25/google-alexa-siri-randomly-answer-even-without-wake-word-study-says/4833560002/ https://eu.usatoday.com/story/tech/conferences/2020/02/25/go...
- lcvw 5y ago
  The Alexas were for my elderly mother in law. If she fell or was having some sort of problem, she could call us with just her voice. Also she and my partner both like the convenience, so who am I to say that they shouldn’t have such a device? The device does have hardware switches for the camera (it was off) and the microphone but you can’t switch off the microphone without effectively disabling the device. When I she bought these devices they didn’t have this feature. None of us knew that the feature was deployed and enabled by default. To your point, it is a huge issue that we have no control over these devices anymore since the software can be changed at any time and can lie to you (lies of omission usually). The Alexa goes above and beyond imo because when this person gained access to my mother in law’s other accounts, it took about 30 minutes to permanently lock him out, despite him bypassing text based tfa by having compromised her phone. Alexa wouldn’t even tell me this problem existed, and I can’t document what happened unlike with literally every other service.
kello 5y ago
I had no idea this was even a "feature" of Alexa. Super glad I never got one.
jboy55 5y ago
Contact customer support about the deleting the profile, these things usually are taken very seriously, especially if it still is happening. If you don't hear anything back, call CS back and complain, shit will hit the fan then. I used to work in Alexa, and if we ignored a CS complaint like this, it would get escalated quickly and highly. Some of your assumptions about the back end are wrong too. As much as you hear bad news on how Amazon treats their employees, they really do care a lot about their customers.

by lcvw 5y ago

jvolkman 5y ago

What a bizarre situation. For what it's worth, Google Homes don't have this drop-in feature. You can make calls and make announcements, but both require the person on the other end to actively answer or respond.

mensetmanusman 5y ago

That deserves its own post. This reminds me of when Samsung sent the press release that people shouldn’t discuss personal things near their television, because an unpatchable product of their allowed anyone who knew how to tap into the tv mics…

mcv 5y ago
I have always assumed my Samsung TV didn't have a mic. How can I check if it does? I don't really want any mic-using devices that I can't control, although I suppose that ship already sailed when smartphones were introduced.
lcvw 5y ago
It was truly a bizarre experience. First we noticed a random intermittent ringing noise in the house and couldn’t figure out what it was. We tracked it down to the Alexa but since there are no logs or notifications we didn’t know what had just happened. It seems the person hung up when they heard us looking around so we never saw any visible indication that anything was happening. Once we figured it out, we then had to spend half a day going through the Alexa documentation (useless) and random threads on Reddit to figure out how the access control for this feature and Alexa in general works. Like I said, certain changes to your account cannot be made without contacting support and being escalated to a certain team. By the end of it I still could not be certain we had locked this person out because of the number of changes they had made to the account and how much of a mess the app is. The thing I really don’t understand is that this feature has been deployed for over a year and has received negative attention in the press. It’s just unbelievable that they would ship a feature that can turn your Alexa into a listening device and not think through what could go wrong, and never revisit it in a year.
- raffraffraff 5y ago
  Honestly, I find it amazing that so many people let these things into their homes. The price you pay for such little actual utility isn't worth it. I won't use voice recognition on a single device. Not only do I not trust Google/Amazon, I don't trust that I wouldn't accidentally say something that triggers it to phone a person I'm talking about, or order something expensive in the internet. Home Assistant on my phone and lots of physical zigbee controllers works just fine for me. I don't want to talk to my devices. I have an in-law who uses voice recognition to dictate messages into WhatsApp extended family group and some of the shit she's posted is hilariously (unintentionally) spicy. Her kids get into stupid "conversations" with Alexa. They're 8. Just no.
  - sneak 5y ago
    Most people believe that they have nothing to hide. To them, there is no cost in lost privacy because they do not value privacy. The sad part is, for most people who say this, it's true. Their lives indeed contain nothing interesting enough to be worth concealing.
kkjjkgjjgg 5y ago
Why does a TV even have mics. Crazy world.
- maccard 5y ago
  Because all of the high end TVs contain alexa/google home integrations.
  - wccrawford 5y ago
    Or even just their own search-by-voice functionality, which is useful to many people, especially those with disabilities.
    - maccard 5y ago
      That's a fair point. Samsung and LG both have their own smart integrations too in the form of iQ and Bixby.
detaro 5y ago
> This reminds me of when Samsung sent the press release that people shouldn’t discuss personal things near their television, because an unpatchable product of their allowed anyone who knew how to tap into the tv mics… Do you have a link for that one?
- cassianoleal 5y ago
  I imagine they mean this. https://www.cnet.com/tech/services-and-software/samsungs-warning-our-smart-tvs-record-your-living-room-chatter/ https://www.cnet.com/tech/services-and-software/samsungs-war...

BiteCode_dev 5y ago

Well you installed an always on microphone in your house, attached to a processing unit connected to internet all the time. People said again and again it's going to be abused, and you had the technical knowledge to evaluate the risk. Yet you went with it. If it was not your scenario, it would have been another one. There will be other ones. Hell, with things like PRISM, that's inviting 3 letters agencies in your bedrooms. Since the pandora box is opened and people are going to do it anyway, we should at least militate for having hardware switches on any sensors for any device.

dorgo 5y ago
>Well you installed an always on microphone in your house, attached to a processing unit connected to internet all the time. How is it different from a smartphone or notebook?
- philwelch 5y ago
  You can put them in the freezer like Edward Snowden.
- BiteCode_dev 5y ago
  Intent. I don't have my phone expecting it to listen to all the room, all the time. It could, but if it is, it's not a deliberate choice. The microphone is not made of this, I regularly put it in plane mode, I don't have an account linked to the phone nor smart assistant actives. Listening to my phone all the time would require targetting, since it's not, unlike alexa, doing so by design: https://eu.usatoday.com/story/tech/conferences/2020/02/25/google-alexa-siri-randomly-answer-even-without-wake-word-study-says/4833560002/ https://eu.usatoday.com/story/tech/conferences/2020/02/25/go...
lcvw 5y ago
The Alexas were for my elderly mother in law. If she fell or was having some sort of problem, she could call us with just her voice. Also she and my partner both like the convenience, so who am I to say that they shouldn’t have such a device? The device does have hardware switches for the camera (it was off) and the microphone but you can’t switch off the microphone without effectively disabling the device. When I she bought these devices they didn’t have this feature. None of us knew that the feature was deployed and enabled by default. To your point, it is a huge issue that we have no control over these devices anymore since the software can be changed at any time and can lie to you (lies of omission usually). The Alexa goes above and beyond imo because when this person gained access to my mother in law’s other accounts, it took about 30 minutes to permanently lock him out, despite him bypassing text based tfa by having compromised her phone. Alexa wouldn’t even tell me this problem existed, and I can’t document what happened unlike with literally every other service.

kello 5y ago

I had no idea this was even a "feature" of Alexa. Super glad I never got one.

jboy55 5y ago

Contact customer support about the deleting the profile, these things usually are taken very seriously, especially if it still is happening. If you don't hear anything back, call CS back and complain, shit will hit the fan then. I used to work in Alexa, and if we ignored a CS complaint like this, it would get escalated quickly and highly. Some of your assumptions about the back end are wrong too. As much as you hear bad news on how Amazon treats their employees, they really do care a lot about their customers.