Hacker News Reader

Comment by mattmanser | Hacker News Reader

Isn't this trivial to check if you just inspect the network traffic?

This is exactly what I would imagine. What is it about this topic that causes HN-types to drop all sense of logic and critical thought?

People have been claiming Facebook eavesdrops on conversations for years now, yet no one has been able to technically prove it. Facebook is a huge target for people to 'decompile', reverse engineer and sniff network traffic, which has been done multiple times, yet no one has been able to identify this.

This is of course ignoring the fact that its 'supposed' to be impossible for iOS apps to use the microphone without the status bar from going obviously red. It would be extremely surprising if there was a venerability that only Facebook knew about that they were exploiting to bypass iOS.

They might have a neural network that preprocesses the input first; then it would be quite difficult to understand its output.

If you mean doing speech to text on the device then that was my first thought as well. But DSP isn't cheap and we are talking about serious battery consumption. Even if they cache audio and only process it while the phone is charging then they would still need the algorithms baked into the binary (researchers could find em) unless they somehow sidestep the app stores not allowing remote code to be loaded.

They could have a really cheap algorithm that just tries to inexpensively match audio fingerprints in windows of audio. I guess if you have trillions of hours of audio it's ok not to inspect every minute to the fullest extent.

It's an interesting problem to think about but as other hackers have mentioned: why would they risk doing it in secret? They could just update the EULA.

If (it's not) it were true it wouldn't have to be sent in clear text or even at once though. There's tons of ways they theoretically could send data that wouldn't be obvious from looking at network traffic.

That would mean Facebook would have a natural language processor that works and fits on a phone. I thought that's way past the state of the art atm. Otherwise you could just look for large amounts of data being sent to their servers.

Custom CAs being ignored for the applications makes it a bit difficult so not trivial but possible by modifying the app.

Reply on news.ycombinator.com