Hacker News Reader

Comment by mikeryan | Hacker News Reader

So I have a bit of intimate knowledge of this.

Not sure what I can answer but for years my company worked on an Automatic Content Recognition project using tools from a team called Cognitive Networks who were bought by Vizio and makes up the tech that did this. If I understand correctly the founder of Vizio kept this tech for himself in the sale of Vizio.

When developing this we would work directly with Cognitive checking sync'd apps. We knew for a long time that they could see our content in their office while we tested.

Note LG got caught on this about 2-3 years ago and made ACR apps opt-in which pretty much killed it for LG.

AFAIK Samsung never did the exact same thing a bunch of providers saw the writing on the wall and dumped this sort of technology a few years back. It had some really cool applications for interactive sync to broadcast apps but the privacy concerns killed it for a lot for a lot of manufacturers.

View on HN

Thanks for posting this. When I saw the original FTC story I recalled reading about this once or twice in the past but couldn't think of any key phrases or sources.

In response to some of the other comments here, basically what they are guilty of isn't spying but failing to properly disclose and opt-in users. There is a particular major AV vendor who is selling raw clickstream data of millions of their user's internet usage directly to marketers and other parties right now. As far as I can tell, as long as it is buried somewhere in the terms and conditions no one cares.

Of course, other companies that are actually serving the content are doing far more than just passively monitoring your viewing habits.

From my best guess, Facebook is logging every signal it can from content/pictures/videos it displays to users. Even if you didn't click like, comment, or click through the link it knows the story captured your attention.

I had an interesting case with Instagram where after viewing enough pictures of women's butts it started also showing men's bare butts in my feed too.. at least until I never opened any of them, and they disappeared.

Users should consider that content providers are going to have extremely deep data sets of even the most minute dimensions of their political leanings, porn viewing habits, dating preferences, and gullibilities. All of this will make what TV shows you watched between Netflix and NBC beyond mundane.

With an open web, where we get content from the source, this shouldn't actually be possible. Thank the platform business model.

This is why i torrent behind a VPN despite being subscribed to HBO now, Netflix, and Amazon Video. My guilt is ameliorated and at least a sliver of ny privacy is maintained.

You misunderstand how it works. This worked by fingerprinting audio and video at the TV display level, it's not part of the networking layer. If your content was shown on the TV you could be tracked regardless of source.

Thanks and noted. If I ever end up getting a SmartTV (due to dumb TV's no longer being sold), it's never getting on my network and going to be banned at the mac address level.

It needs to be physically disconnected or on a network without Internet connection. The Mac address is the easiest to spoof. If it has any kind of radio like WiFi you need to de-solder it, as the data could be collected by a car driving by, or via your neighborers Wifi.

> as the data could be collected by a car driving by, or via your neighborers Wifi.

What?

How is it going to connect to your neighbours wifi? How is someone driving past going to connect to your TV? Is the TV going to set itself up as an access point?

I'm completely behind not connecting random devices in my house to the internet but suggesting they are somehow trying to get data out by connecting to random networks or will just broadcast it for anyone to hear is a bit much.

The neighbours might have an access point without a password. But I think if the vendor is really interested in collecting personal data he could just install a GSM modem with a prepaid SIM card inside so that the device doesn't depend on Internet connection.

Multiple compromised nodes working together to identify you.

We already see this with things like ultrasonic communication. A compromised (has sketchy app installed) phone could, for example, communicate with your television or computer speakers and mic via ultrasonic frequencies to determine what ads you have seen, or what digital streaming content you are consuming.

An app could take it even a step further and use a root exploit and secretly take a short recording every 10 minutes or so to relay to someone who wants to know what song or movie you were consuming.

This isn't just possible, things like this have already been found in the wild.

And you can bet your bottom dollar these snaky companies would keep their mouths shut under a NSL if it meant they could keep tracking you.

https://www.schneier.com/blog/archives/2015/11/ads_surreptit...

It doesn't even require anything that complex. If I remember correctly, even if your smartphone never connects to wifi AP's, while thhe WiFi radio is on, it does periodically scan for AP's in the area while either surrendering some identifiable information or establishing a pattern that can be used to identify you.

Frak it, TV is going in a Faraday cage

Get a projector a and a dozen or two bulbs and prepare for the technological winter.

I think the parent is being purposefully hyperbolic ... however, a router manufacturer could have a ghost APs that domestic goods could try to send via. It perhaps wouldn't be the weirdest invasion of consumer privacy story either.

In the UK nearly everywhere send to have a BT WiFi signal as they give out routers with a commercial side-channel that anyone can pay to access. If your smart device had access to BT WiFi they'd get a signal out in many places regardless of whether the TV owner had WiFi.

/EvilGenius

If they really wanted to collect the data, they could make the TV auto connect to certain SSID's or any open WiFi.

Also lookup smart water meters, that can be read by driving by.

I'm amazed you can access Netflix behind a VPN.

I don't access Netflix, kind of the whole point :)

Whhen I do use Netflix it's through my PS4.

Why not, when you are abroad it is kinda the only way you can watch many of the content that is not available in other countries. Even subtitles are not available in English in some countries like Sweden.

Because Netflix blocks VPNs since a few months. It's really hard to find a vpn that works with netflix. Even setting up your own won't work, most ip ranges that are used by data centres are blocked by default.

He said he pays for Netflix, but torrents on a VPN.

That's a bingo!

Heck if your using a tunnel broker for ipv6, it thinks your using a vpn, sigh.

That sort of makes sense, given that is also punching through the geoblock.

I understand that, but I'm using an endpoint in the same physical area my actual internet connection is (NoVA).

I thought Netflix and related services work the same way Spotify does: they pay content providers a small fee based on actual content viewing. If you pay Netflix a monthly subscription but never view any content on your account, I would assume Netflix keeps all of the revenue and doesn't pay out anything to the actual content providers. Just a guess, but it's possible your plan is backfiring by paying the company you don't want to support (since Netflix is the one implementing the tracking) instead of the companies you do (that actually create the content you like).

Netflix also makes a lot of their own content. If he is pirating that content, then it's fair.

I think Netflix greenlights 3rd party content creator's projects, I'm not sure they have much if any in-house production.

Those deals probably include some combination of up-front payment as well as per-view payment.

Spotify, at least, pools all payments before paying royalties.

So his strategy does increase royalty payments, but doesn't "vote" for who should receive those royalties.

Actually no, in contrast to Spotify, they generally secure licenses for content for a flat fee and a 1-3 year time frame. It doesn't matter how much content is actually viewed, other than Netflix deciding whether it's worth trying to renew or not.

http://www.investopedia.com/articles/investing/062515/how-ne...

No - as a general rule, Netflix pays a fixed royalty for the content that they license from third parties, regardless of how many people watch it. This is why the quality of their predictive models is so important; the better they can forecast, the better they can determine whether the price they would have to pay is worth it.

(Of course, the royalty is different for every piece of content, but the amount is negotiated ahead of time; it is not on a per-usage basis.)

This is different from iTunes movies, Amazon (non-Prime) Video, Vudu, Google Play, etc., which license on a revenue share basis.

> your plan is backfiring by paying the company you don't want to support (since Netflix is the one implementing the tracking) instead of the companies you do (that actually create the content you like).

TBH, that's for too deep for my moral calculus. The only things I view/pirate from Netflix are Netflix original series and PBS documentaries/educational programs. I'm paying the former directly and the latter isn't really out to maximize profit but to enlighten and educate and it's somewhat supported by my tax dollars.

Is it possible to bring about a similar complaint against Facebook with the FTC? Or, if the FTC is the wrong agency, what would be the right one?

Of particular concern are "shadow profiles" - dossiers on people who have never even used or consented to using Facebook[1]. I'm no lawyer, but there could be precedent per this Vizio case.

In my opinion Facebook is hugely overstepping people's privacy bounds, even if they do bury what they do with some of the data in their terms of service. I never even knew about DeepFace, or mouse cursor movements, or any of the multitudes of violations of privacy outlined in the article below, and frankly it scares me and makes me angry.

[1]http://veekaybee.github.io/facebook-is-collecting-this/

crickets

By using FB, you consent to them using the information about you that others and you yourself provide. Dont like it? Dont use FB.

don't like the single de facto platform for communication online? don't use it. i'm sure your friends will get ahold of you somehow. maybe whatsapp?

On the one hand, Facebook is ubiquitous enough that the government could probably step in and regulate them and it wouldn't be entirely unreasonable. On the other hand, I don't use Facebook and I'm getting along just fine. I have an account but log in about once a year. "Don't use it" is a legitimate option.

They still track you even if you don't have an account. Your friends give them more than enough info for them to create a detailed dossier.

> dossiers on people who have never even used or consented to using Facebook

I think you misread the comment. These are people that already don't use Facebook.

By that logic, we shouldn't buy or use Vizio TVs either. But the issue here with the FTC complaint is that there was not a prominent warning that the data was being collected or used in such a way.

I certainly never read or even saw any warning about facial matching in all my photos or my children's photos.

Besides all that, people with shadow profiles who never even used Facebook or agreed to their TOS are being tracked. This is not ok.

I feel like there is a double standard here: we are vilifying Vizio - a company that has mutliple competitors - for much less wrongdoing than what Facebook is guilty of, even though FB has a de facto monopoly on social networking.

Edit: there is a link on the ftc.gov website where you can file a complaint against a company with concerns how it handles your privacy: https://www.ftccomplaintassistant.gov/Company#crnt

> By that logic, we shouldn't buy or use Vizio TVs either.

Burn it all. Facebook and Vizio.

And every other company. Go live in a cave because thats where all companies are going and no one is slowing the process down. This consumer choice gambit very well be a false statement in the future.

Except a lot of people are forced to use FB either for work or by friends/family. Without the right IRL social network these people are very disadvantaged given that practically everything social (as in, real life people hanging out, not "social" media) is on FB nowadays

> I had an interesting case with Instagram where after viewing enough pictures of women's butts it started also showing men's bare butts in my feed too.. at least until I never opened any of them, and they disappeared.

This truly is technology run amok. "Welcome to buttstagram, for your butt viewing pleasure."

When I think about this situation it makes me want to stay entirely away from social media and off the internet. Yet it's ubiquity in our lives makes it difficult to be integrated and participant in society without the technology. And a lot of the features really do disappear when you remain entirely anonymous (via tor, incognito, not having accounts etc).

Wait, what's cloudstagram?

That's a very subtle joke :)

(Those in the dark search for cloud2butt browser plugin)

That is my favorite extension. It subtly brightens my day when I come across one of its gems.

I had a similar thing happen a year or two ago: At some point in the past I shut down my Facebook page, but a year later I created a new minimalistic one so I could stay in touch with my family. I posted a picture of a Vespa scooter I'd been restoring in the garage, and suddenly my suggested friends list started overflowing with guys in Indonesian scooter gangs and young asian ladies in head scarfs. (I friended one guy and we exchange "likes" every once in a while but even google translate doesn't understand 3/4 of what he says.)

> Yet it's ubiquity in our lives makes it difficult to be integrated and participant in society without the technology.

Or: Yet the ubiquity in our lives of Stuff that was never built for us (pretty sure I never gave the billionaires at FB and Goog as much as a single dollar), but merely to lure us, makes it difficult to be integrated with and unwittingly enabling that Stuff without installing and using that Stuff.

>here is a particular major AV vendor who is selling raw clickstream data of millions of their user's internet usage directly to marketers and other parties right now. As far as I can tell, as long as it is buried somewhere in the terms and conditions no one cares.

ugh. Name them please! If it's in the ToS they shouldn't mind being called out.

Avast, source https://news.ycombinator.com/item?id=13079569 AJ007

Here are the terms, it's in section 8.Privacy, processing of personal information. https://www.avast.com/eula-avast-free-products

However "AVAST may publish or share such information with third parties that are not part of the AVAST Group but will only ever do so after removing personally identifiable information."

Also: https://www.pehub.com/2015/05/avast-leads-22-mln-round-for-j...

"Jumpshot also captures https clickstream data to reveal in-depth buying and social behavior above and beyond simple browsing."

Capturing https clickstream data is only possible when you MITM the user - see Avast.

They could make a deal with browser extension developers to bundle a surveillance module. That is why I never install any browser extensions.

They could for sure - others already did that and bought well running extensions.

https://www.reddit.com/r/IAmA/comments/1vjj51/i_am_one_of_th...

At least, not all extension developers gave in to $$$.

> removing personally identifiable information

no such thing.

Surveilling users without their knowledge and consent sure sounds like spying to me

Facebook categorises a video view as anything seen for more than three seconds, so draw your own conclusions from that.

Instagram was purely chronological until mid way through last year. And it only shows you content you've subscribed to. So it's possible an account you were following changed its posting habits.

What Facebook is doing is quite frankly scary. This Sunday over a birthday meeting with some friends, one of them was telling us about a restaurant called "Lucuma" (this is in Guadalajara, Mexico). My wife did nothing with her cell-phone, except having it with her during the conversation.

Later that day when we are back at home, she showed me an ad about that same restaurant. We never searched for something similar (this is a vegan restaurant), but only talked about it on our way home.

The restaurant most likely bought some ads that targeted your wife and your friends' demographic. It's far easier to do that than covertly access your phone's mic.

It's also possible that the friends saw this ad first, thus planting the idea in the first place.

Your wife's friends probably searched it and facebook lumped you all together in their algorithm.

Still creepy.

Here in NY recording people without their consent is definitely against the law and is likely to piss off important people. As fun as this CT is it seems extraordinarily unlikely that FB employees would risk going to jail for this feature.

I'm curious, did anyone on your team raise any ethical concerns in regards to the potential privacy violation? If not, how was the topic handled by employees/management?

I'd expect it wasn't handled. If it comes up, 'Let legal deal with it'.

If we expect employees speaking up to fix this, we are going to live in constant disappointment. The pro-privacy people live in a very small, but loud, echo chamber. We need to be proactive with developing pro-privacy technologies if we expect something to be done about this.

The majority of the population and the majority of developers seem to not care at all about intimately targeted ads.

It's not just apathy, it's also because there's often so much you can do without pissing off the management or generally looking like a "bad culture fit". And then they'll get someone else to do it anyway.

At my current job, I don't have any privacy-related issues, but I have to handle occasional clueless ideas from the customer. It usually goes like this:

  They: We want to have this security-related change X.
  Me:   Uh ok... but are you sure it's a good idea? What's your threat model?
  They: ???
  Me:   You see, this change will make it more difficult for user to do Y, with no real
        benefit to security, because A, B and C.
  They: Uh... yes, you're right; let's not do it then.

Fast-forward one or two other attempts at proposing the same change and half a year later, I find the change implemented in the codebase anyway. Turns out some other manager on customer's side asked someone else in my company to implement it.

-.-

Not really - we talked about it and expected more consumer concerns from other outlets. This work was not being done in secret, when ACR was the hot item it was well known in the industry how it worked. We figured the the vendors would deal with the issues as they were raised - and they did despite some of the potential of the technology for some cool interactive apps the most part it died.

The difference between what we worked on and what Cognitive/Inscape eventually did and got dinged for was that we were using this technology to build sync to broadcast apps not for tracking viewing and usage habits. The work we did never got to large scale deployments and we honestly forgot a bit about it. I knew what Inscape was doing - nothing secret just kind of in the industry weeds - post Vizio sale but honestly didn't think that much about it until now.

Guess this is what spurred the investigation: https://www.propublica.org/article/own-a-vizio-smart-tv-its-...

Still, how did this article come about? What is a whistle blower?

A whistle blower is a term for an insider who leaks a company's criminal practices to the government. They can get a percentage of monies recovered through lawsuits

Sorry, I meant to ask "was it a whistleblower?". Just curious how exactly this whole gnarly situation was discovered.

going to be really curious how siri/alexa/google voice activated devices in home are going to be treated in the future. eventually even these will likely have video in ability

What proof do you have for what you're claiming, please? If you have intimate knowledge then you should know that many (me included) could accuse you of trying to push an agenda or divert the attention by posting what you did.

How do you really know LG stopped their data collection? Sure they might have made a checkbox be switched off by default, but what does that say about the underlying software? IMO, nothing. It might have been a PR damage control campaign without an actual change.

As a former Cognitive and Inscape employee, @mikeryan is largely correct. Note that fingerprinting happens on the TV - no actual content was sent back to us. Still absolutely creepy.*

* Not the opinion of my (former) employer.

Once the data is sold, the cat is out of the bag. The service might not send sensitive info by itself but the DBs of the buyers might contain enough data for cross-referencing to personally identify you without a shadow of doubt.

As another poster here asked: were there any ethical discussions in the organization?

Individually yes, organizationally not that I know of.

Quick tip: If you actually care about being downvoted, dont complain about being downvoted. Many people will do so just for mentioning it, it is against the rules, and it's whining about imaginary, non-transferrable internet points

Corrected. Foreign thinking to me -- but point is taken. Thank you.

Personally I think it's fine to complain about being downvoted if no-one has responded constructively.

It might not help, of course.

Moreover, without vote visibility you can't tell if the reason given by one person is supported by others.

> Personally I think it's fine to complain about being downvoted if no-one has responded constructively.

I understand that often often times people will use downvotes as a substitute for disagreeing, despite that being explicitly against its true function. Ultimately, you're complaining about fictitious karma points.

If you are a regular contributor who follows the rules, over time your karma will accrue and this can be a fuzzy way to weigh your importance to the community. The danger of valuing karma too much will cause the system to be gamed by marketers and astroturfers (see Reddit for Example A)

>people will use downvotes as a substitute for disagreeing, despite that being explicitly against its true function. //

Early on with HN pg stated that downvoting for disagreement was proper behaviour on HN. My opinion is that's wrong but, in contrast to other fora, downvoting to disagree is thus explicitly a part of proper behaviour here.

That said, I don't care about the points, it's a matter of social value - if you don't know why people are disagreeing then you can't address that concern or reassess your own position, the downvoted adds no value whilst a comment may.

What proof could they actually provide? Given the medium, anything they said is probably easily forgeable or illegal to share. That being the case, demanding proof is just a way for you to look "skeptical" without providing much of value to the conversation. I'm guessing you meant well, but apparently others thought differently.

We all know people lie on the internet sometimes. We can't explicitly bring up the possibility everytime someone makes any statement, or half the internet would be "careful, this might not be true!".

I don't disagree with anything you said. It's just that this is a high-profile case (IMO anyway). I guess I am expecting too much.

Not to mention non-disclosure agreements and such.

What I want to know is, how did Vizio get caught? Was there a whistle blower. This article doesn't mention (unless I just missed it) how the FTC discovered this.

Nothing I've said is "secret" anyone active in the Smart TV or Interactive TV space knew this was going on and how it worked. When I said intimate I didn't mean secret, I mean I actually used the technology being discussed, and at its very nascent stage.

There were multiple ACR Vendors doing the same thing (Gracenote, Samba TV are two at top of my head, there were many failed vendors in this space)

Google ACR on TVs and you'll find all the info you need https://en.wikipedia.org/wiki/Automatic_content_recognition

https://techcrunch.com/2015/01/04/cognitive-networks-ces/

(BTW the app in that techcrunch article is the one we worked on)

Reply on news.ycombinator.com