4 ms·

These kinds of topics come up frequently ("Your phone is secretly tracking you!!!") and this may sound a bit harsh but it always is interesting to me how people

These kinds of topics come up frequently ("Your phone is secretly tracking you!!!") and this may sound a bit harsh but it always is interesting to me how people aren't able to use basic critical thinking skills to debunk them. It's like I sometimes say "The conspiracy theory doesn't even make sense even if you take everything it presupposes at face value": 1. As you point out, this isn't even some "super secret government" tracking you. They are basically advertising that anyone selling any random shit could take advantage of this feature. So obviously it would be trivially easy for anyone with the motivation to go and buy some of these ads to get clarity if some voices were actually being tracked. There is literally no way for this technology to be hidden given how it is described in TFA. 2. Companies don't need these secret tracking technologies, because the overt tracking ones already give them tons of information: your location, what you searched for, browsing history, your friends and family, etc. etc. 3. Given that ads are already super targeted, whenever this story comes up you always get these anecdotes of "I was talking about some totally random thing like pantyliners and then THE VERY NEXT AD I SAW WAS FOR pantyliners! Indisputable proof!" I've certainly had a similar experience. But it's certainly not that hard to see how these kinds of coincidences would be quite common given how good ad targeting already is. Like the saying goes, "Anyone who is a conspiracy theorist has never been a project manager..."

api 2y ago
These companies are themselves claiming they can do this. They could be lying, but it’s not at all unreasonable to take their word for it when so many people report dramatic specific hits on their speech. If the CIA put up a page on their web site saying that they really did sell crack in the 80s, would you still try to debunk that claim? (to pick a random example)
- PaulDavisThe1st 2y ago
  I would at least ask what the CIA has to gain from admitting this.
- hn_throwaway_99 2y ago
  > These companies are themselves claiming they can do this. "These companies" in this context are shitty 3rd rate ad companies that have provided no proof of their capabilities. The reason it's fine to dismiss their claims as BS is that the companies that actually make the devices have explicitly said it's not possible, and if these device-making companies were lying it would be a scandal of gargantuan proportions.
  - api 2y ago
    The device makers may not think it's possible, but that doesn't mean it's not happening. The very definition of a vulnerability is something someone finds that someone does not know is possible. This could also be a weasel answer. What they're saying is that apps are not allowed to do this via official permissions or channels in the OS. It's like YouTube saying there is no CSAM on YouTube. What they're saying is that they do not allow CSAM on YouTube and remove it when they find it, not that it can't possibly exist. I posted this elsewhere as one possible method: https://arxiv.org/abs/2212.01042 https://arxiv.org/abs/2212.01042 Phones have so many sensors with legitimate uses it might actually be hard to prevent an AI-enhanced sensor fusion approach from extracting this kind of information. Mitigations may require things like the injection of randomness into sensor feeds, which is also a mitigation used to prevent timing side channel attacks against hardware. But this is a lot harder to get right than it sounds. You have to make sure it's enough randomness to completely swamp the signal but not enough to destroy the usefulness of the system. Then there are microphones in devices like smart TVs and other Wifi-enabled gadgets that have a well established history of shady behavior. It may not be your phone. It may be other devices in the room. But if your phone is there then your location can be matched to the data later in a data fusion pipeline. As for these being crappy little companies: (1) if you listen to the pod or read some of the articles on this, some of them are larger companies like Cox Media Group and (2) crappy little companies are actually more likely to do shady fly by night shit. I'd find it much more likely that some crappy little adware company would do something like this than Meta or Google, because the latter can be sued while the former will just evaporate if you try to sue it. But once the data is gathered it'd be sold to data brokers where it'd be fused with lots of other data and made available to larger companies to power their targeting algorithms. This is how the adtech industry operates. The shady stuff is done by disposable or offshore companies and then the data is laundered through the data broker market. I don't know if acoustic eavesdropping is happening at any scale, but I am absolutely 100% sure that if it can be done it is being done by someone.

api 2y ago

These companies are themselves claiming they can do this. They could be lying, but it’s not at all unreasonable to take their word for it when so many people report dramatic specific hits on their speech. If the CIA put up a page on their web site saying that they really did sell crack in the 80s, would you still try to debunk that claim? (to pick a random example)

PaulDavisThe1st 2y ago
I would at least ask what the CIA has to gain from admitting this.
hn_throwaway_99 2y ago
> These companies are themselves claiming they can do this. "These companies" in this context are shitty 3rd rate ad companies that have provided no proof of their capabilities. The reason it's fine to dismiss their claims as BS is that the companies that actually make the devices have explicitly said it's not possible, and if these device-making companies were lying it would be a scandal of gargantuan proportions.
- api 2y ago
  The device makers may not think it's possible, but that doesn't mean it's not happening. The very definition of a vulnerability is something someone finds that someone does not know is possible. This could also be a weasel answer. What they're saying is that apps are not allowed to do this via official permissions or channels in the OS. It's like YouTube saying there is no CSAM on YouTube. What they're saying is that they do not allow CSAM on YouTube and remove it when they find it, not that it can't possibly exist. I posted this elsewhere as one possible method: https://arxiv.org/abs/2212.01042 https://arxiv.org/abs/2212.01042 Phones have so many sensors with legitimate uses it might actually be hard to prevent an AI-enhanced sensor fusion approach from extracting this kind of information. Mitigations may require things like the injection of randomness into sensor feeds, which is also a mitigation used to prevent timing side channel attacks against hardware. But this is a lot harder to get right than it sounds. You have to make sure it's enough randomness to completely swamp the signal but not enough to destroy the usefulness of the system. Then there are microphones in devices like smart TVs and other Wifi-enabled gadgets that have a well established history of shady behavior. It may not be your phone. It may be other devices in the room. But if your phone is there then your location can be matched to the data later in a data fusion pipeline. As for these being crappy little companies: (1) if you listen to the pod or read some of the articles on this, some of them are larger companies like Cox Media Group and (2) crappy little companies are actually more likely to do shady fly by night shit. I'd find it much more likely that some crappy little adware company would do something like this than Meta or Google, because the latter can be sued while the former will just evaporate if you try to sue it. But once the data is gathered it'd be sold to data brokers where it'd be fused with lots of other data and made available to larger companies to power their targeting algorithms. This is how the adtech industry operates. The shady stuff is done by disposable or offshore companies and then the data is laundered through the data broker market. I don't know if acoustic eavesdropping is happening at any scale, but I am absolutely 100% sure that if it can be done it is being done by someone.