4 ms·

I hear this theory being claimed so much, but I don't see any real evidence for it; we have routers that you can monitor traffic on, we have microphone use ind

I hear this theory being claimed so much, but I don't see any real evidence for it; we have routers that you can monitor traffic on, we have microphone use indicators on mobile, and I would imagine it would be pretty clear if an app was uploading audio with even very basic monitoring tools. Correct me if I'm wrong, however. I'm not denying that a lot of data is likely surreptitiously collected, but I'm talking microphone/camera in particular.

jesterson 8mo ago
I recall there were quite a few experiments where people use certain keywords heavily just to get closely related ads later on. I can totally relate my experience with it as well. Of course it is inconclusive - but if there is an incentive, management of big companies will venture into it. And chinese management is no different from western ones to that matter.
- gkbrk 8mo ago
  They don't pick the keywords uniformly randomly from a list of all keywords though. They think they randomly picked something that popped up in their mind, but those keywords are either - stuff they saw online recently — ads or otherwise, which put the keywords in their mind - or stuff they were already interested in recently Not hard to imagine targeting algorithms picking up on either of these
  - MadnessASAP 8mo ago
    As I tell my friends You dont see those "coincidental" ads because your phone is listening to you, you see them because your freind showed interest in the product and theirs enough information to infer they talked to you about it. The good news is, your phone isn't listening to you without your consent. The bad news is, because it doesnt need to.
  - jesterson 8mo ago
    Are those your assumptions or something that have been tested?
- nottorp 8mo ago
  It's been a while since I browsed anything without an ad blocker. Do you still get ads for the exact thing you just bought for a week after buying it? :)
deleted 8mo ago
[deleted]
sciencejerk 8mo ago
we have routers that you can monitor traffic on Most traffic is encrypted with HTTPS unless you can root every single device you own we have microphone use indicators on mobile, and I would imagine it would be pretty clear if an app was uploading audio with even very basic monitoring tools. Complicated smartphone OS, firmware, drivers might have bugs allow overrides of visual indicators. Companies have also been known to secretly eavesdrop and not tell users before (Apple + Siri https://www.courthousenews.com/judge-approves-95-million-apple-settlement-over-siri-privacy-case/ https://www.courthousenews.com/judge-approves-95-million-app...)
- gruez 8mo ago
  >Most traffic is encrypted with HTTPS unless you can root every single device you own >Complicated smartphone OS, firmware, drivers might have bugs allow overrides of visual indicators. This line of thinking gets dangerously close to unfalsifiable territory. If apps are eavesdropping on us, where's the network data? It's encrypted. But you can disable https pinning by jailbreaking/rooting? The spying logic automatically disables if it detects it's jailbroken/rooted. Where's the jailbreak/root detection logic? It's buried in 9 layers of obfuscation so you can't find it. What about microphone indicator? They found a 0day in both Android and iOS, or the two are complicit as well. But we don't see any backdoors in AOSP? It's built into the hardware/baseband itself. >Companies have also been known to secretly eavesdrop and not tell users before (Apple + Siri https://www.courthousenews.com/judge-approves-95-million-app https://www.courthousenews.com/judge-approves-95-million-app...) "secretly eavesdrop" implies they were intentionally doing it, when even the plaintiffs admit it wasn't intentional.
- inventor7777 8mo ago
  That is fair. I do not think anyone could feasibly could detect/extract the exact data sent, because of HTTPS. However I was more thinking of simple things, such as disabling anything that SHOULD be communicating with the Internet and seeing if any constant traffic persists. Now of course, some very small (e.g plaintext) traffic might be almost undetectable, however that would suggest that most of the data would not be able to be transmitted due to size.
anonym29 8mo ago
How confident or certain are you of what CSME or PSP or some code in TrustZone is doing? How certain are you that not a single piece of software on your machine, be it in the kernel, userland, drivers, is performing some type of surreptitious communication with CSME or PSP or program running in TrustZone? Do you know for sure whether PSP or CSME has ever done DMA, or fingerprinted stack/heap allocation patterns and timing, or inspected the contents of your disk (after FDE was done being decrypted, of course), to evaluate whether common packet capture software is installed, or even whether it's currently running? Detecting spyware is one thing. Detecting surreptitious nation-state spyware that behaves differently when it's being observed is a different challenge entirely.
- inventor7777 8mo ago
  In my case, I don't currently have any capture software on my main computer at all. Our routers are Asus, and so I'm able to install tcpdump and log traffic directly without the source device itself knowing anything. This makes it really easy to monitor the traffic of any device, albeit not knowing exactly what it is being sent. But it is true that I really can't know much more than what tcpdump shows.
  - anonym29 8mo ago
    Now, how confident are you of all of the above, but instead of for your computer, for your router?

jesterson 8mo ago

I recall there were quite a few experiments where people use certain keywords heavily just to get closely related ads later on. I can totally relate my experience with it as well. Of course it is inconclusive - but if there is an incentive, management of big companies will venture into it. And chinese management is no different from western ones to that matter.

gkbrk 8mo ago
They don't pick the keywords uniformly randomly from a list of all keywords though. They think they randomly picked something that popped up in their mind, but those keywords are either - stuff they saw online recently — ads or otherwise, which put the keywords in their mind - or stuff they were already interested in recently Not hard to imagine targeting algorithms picking up on either of these
- MadnessASAP 8mo ago
  As I tell my friends You dont see those "coincidental" ads because your phone is listening to you, you see them because your freind showed interest in the product and theirs enough information to infer they talked to you about it. The good news is, your phone isn't listening to you without your consent. The bad news is, because it doesnt need to.
- jesterson 8mo ago
  Are those your assumptions or something that have been tested?
nottorp 8mo ago
It's been a while since I browsed anything without an ad blocker. Do you still get ads for the exact thing you just bought for a week after buying it? :)

deleted 8mo ago

[deleted]

sciencejerk 8mo ago

we have routers that you can monitor traffic on Most traffic is encrypted with HTTPS unless you can root every single device you own we have microphone use indicators on mobile, and I would imagine it would be pretty clear if an app was uploading audio with even very basic monitoring tools. Complicated smartphone OS, firmware, drivers might have bugs allow overrides of visual indicators. Companies have also been known to secretly eavesdrop and not tell users before (Apple + Siri https://www.courthousenews.com/judge-approves-95-million-apple-settlement-over-siri-privacy-case/ https://www.courthousenews.com/judge-approves-95-million-app...)

gruez 8mo ago
>Most traffic is encrypted with HTTPS unless you can root every single device you own >Complicated smartphone OS, firmware, drivers might have bugs allow overrides of visual indicators. This line of thinking gets dangerously close to unfalsifiable territory. If apps are eavesdropping on us, where's the network data? It's encrypted. But you can disable https pinning by jailbreaking/rooting? The spying logic automatically disables if it detects it's jailbroken/rooted. Where's the jailbreak/root detection logic? It's buried in 9 layers of obfuscation so you can't find it. What about microphone indicator? They found a 0day in both Android and iOS, or the two are complicit as well. But we don't see any backdoors in AOSP? It's built into the hardware/baseband itself. >Companies have also been known to secretly eavesdrop and not tell users before (Apple + Siri https://www.courthousenews.com/judge-approves-95-million-app https://www.courthousenews.com/judge-approves-95-million-app...) "secretly eavesdrop" implies they were intentionally doing it, when even the plaintiffs admit it wasn't intentional.
inventor7777 8mo ago
That is fair. I do not think anyone could feasibly could detect/extract the exact data sent, because of HTTPS. However I was more thinking of simple things, such as disabling anything that SHOULD be communicating with the Internet and seeing if any constant traffic persists. Now of course, some very small (e.g plaintext) traffic might be almost undetectable, however that would suggest that most of the data would not be able to be transmitted due to size.

anonym29 8mo ago

How confident or certain are you of what CSME or PSP or some code in TrustZone is doing? How certain are you that not a single piece of software on your machine, be it in the kernel, userland, drivers, is performing some type of surreptitious communication with CSME or PSP or program running in TrustZone? Do you know for sure whether PSP or CSME has ever done DMA, or fingerprinted stack/heap allocation patterns and timing, or inspected the contents of your disk (after FDE was done being decrypted, of course), to evaluate whether common packet capture software is installed, or even whether it's currently running? Detecting spyware is one thing. Detecting surreptitious nation-state spyware that behaves differently when it's being observed is a different challenge entirely.

inventor7777 8mo ago
In my case, I don't currently have any capture software on my main computer at all. Our routers are Asus, and so I'm able to install tcpdump and log traffic directly without the source device itself knowing anything. This makes it really easy to monitor the traffic of any device, albeit not knowing exactly what it is being sent. But it is true that I really can't know much more than what tcpdump shows.
- anonym29 8mo ago
  Now, how confident are you of all of the above, but instead of for your computer, for your router?