Hacker News Reader

Comment by djsumdog | Hacker News Reader

I would never have one of these devices in my home, and I'm surprised I see so many of them in homes of people who are in the tech industry. I wondered if people in security would have them and so I contacted one of my good friends who is a security expert. "What's an Alexa device?"

He's a Kiwi. Amazon hasn't made it to NZ yet. He's only seen them on TV shows.

Interestingly this article is nothing about what gets transmitted, but just hacking the device. It would be kinda cool if we started to see projects to turn Amazon devices into one of the open source variants like Jarvis.

View on HN

I think like, with most things, it's all about the tradeoff.

I have one in my house in the living room. It basically exists to have an easy way of turning on Spotify. We don't have sensitive conversations in the living room. If someone were listening, they'd mostly get me scolding my children and asking what's for dinner. The might also steal a token to connect to Spotify. My AWS account isn't linked to the same account as my Alexa, and requires TFA, so that's safe.

I wouldn't put this device in my bedroom. I also was less interested when my kids were young enough that I might actually have a sensitive conversation anywhere. I'd considered putting one in my tv room to control the tv, but that's about it.

I don't regard the Alexa as a greater vulnerability to my house than my phone, and I already accept owning a smart phone. I am concerned about the same things you are, but I view it as more of a trade-off than a simple "just don't do it!" attitude.

Depending on who's listening (post-processing recordings in bulk) and your tone, scolding your children might get you a visit from the authorities if over-eager busibodies are listening.

Do we really need more of that?

I consider that a feature, not a bug - if mining data from always-on devices protected kids who were actually being abused, that would be a win. False positives can be tuned out.

> False positives can be tuned out.

oh-you.jpg

https://en.wikipedia.org/wiki/McMartin_preschool_trial

I fail to see the connection. If Amazon began to analyze recordings to try and find real or even misconstrued abuse (presumably only after legislation required them to - I can't see a business case), they'd reasonably need to adjust what their algo flagged as a match. I'd be curious if Echo (or gHome, or Siri) do any sentiment analysis right now, they don't seem to (or cursing when they botch your command would at least produce more contrition).

Nobody knew what Google was doing for two years.

https://www.wired.com/2012/05/google-wifi-fcc-investigation/

So, yeah, these appliances could be doing anything at any future point due to remote updates.

Do you really think that's even in the realm of possibility? There is so much paranoia-driven FUD in these comments.

But let's say that yes, this absurd hypothetical is possible and happens.

Someone is capturing full audio from your device even though it allegedly only transmits when certain phrases are used (e.g., "Alexa..."). They've tunneled through your modem, router and AP and are capturing directly from your device.

That same someone is somehow able to process hours of ambient sounds, conversations and everything else to pick out someone using an inappropriate tone with their children.

They then take these recordings to a local child protection agency (e.g., CPS) and present the audio along with your information to develop an actionable case against you.

That child protection agency then decides your tone was strong enough that they need to pursue legal action.

How does this hold up in court? How does illegally-obtained audio stand as evidence? How are they able to prove it was you and not a relative or visitor?

It won't hold up; this is insane. Your point about the wrong tone being used against you is insane. I get being paranoid and not trusting these devices but get real!

You'd be surprised how crazy CPS is if you aren't wealthy and white. They don't actually seem to even need any "evidence" really.

I agree it seems unlikely, though, especially if you are relatively wealthy and white. (Also who is hacking into your system with this as their goal and how likely is that? On the other hand, in the age of swatting, anything seems possible.)

As we continue to advance universal surveillance though (self- and other-), I think we will start to see stuff like this happening more. It'll take a little while.

> You'd be surprised how crazy CPS is if you aren't wealthy and white. They don't actually seem to even need any "evidence" really.

For example (white, but not wealthy): https://www.usatoday.com/story/news/nation/2015/04/13/parent...

> Montgomery County police and county Children's Protective Services are jointly investigating the Meitivs of Silver Spring for allowing their children to walk repeatedly around the neighborhood alone. The parents say they know where their children are but are allowing them independence.

> Officers picked up the children about two blocks from home, Rafi said, telling them they would drop them off at home. Instead, the two sat in a patrol car for 2½ hours then were taken about 10 miles away to Children's Protective Services offices in Rockville, Md.

>You'd be surprised how crazy CPS is if you aren't wealthy and white.

Even then, I have some relatives (white and middle-class) that lived in an apartment. The people on the other side of the wall reported them for yelling at their kids. Fortunately for them they had a friend at the CPS who called them and told them that CPS was coming the next morning to take away their kids. So they packed up and moved out of state that night.

Yeah, good point, it's not limited to the white and not wealthy, but like everything else in society, the more resources you got, the more you can avoid them (and being white is indeed a resource in our society). But yeah, CPS is scary shit.

> You'd be surprised how crazy CPS is if you aren't wealthy and white.

When people say they have nothing to hide, they're also saying they have no abuse of power to confront, and nobody who is persecuted to stand with in solidarity. And for some reason, they think they're the standard, or that any of this is new. Look into history, with any totalitarian government, any oppressive king, you'll always find people going "doesn't affect me". It's as old, and as valuable, as dirt.

> Someone is capturing full audio from your device even though it allegedly only transmits when certain phrases are used (e.g., "Alexa..."). They've tunneled through your modem, router and AP and are capturing directly from your device.

It's not remotely out of line to discuss the implications of hijacking an Alexa in a discussion thread on an article that describes exactly how to hijack an Alexa. You don't have to sound incredulous about that part...

You're picking a piece out of my full response and adding context I didn't provide. I said the overall statement was absurd, not that capturing audio was.

And you've advanced an over-engineered scenario as a counter-argument to my observation. I think you can cut this guy some slack.

His point was, if you're hijacking an Alexa, those recordings are now illicit and not submissible in court.

Look at what prosecutors do today with internet history. They search through whatever they can find in the browser history of a supposedly guilty suspect, cherry pick anything remotely incriminating, and use it completely out of context to support whatever case they are trying to build. I don’t think it’s one bit far fetched or paranoid to see something similar happening if they could ever get access to a suspects indexed conversations.

You have no experience with CPS, do you? There is no court involved at the beginning. They can just take your children away on their say so. Afterwards you will have to go though the courts to get them back.

That's a ridiculous scenario.

How about, "Alexa itself transmits to the cloud. 10 years from now, a scanning service post-processes recordings using sentiment analysis and emotional state tracking now required by the new administration. State regulators have determined that parents should not talk to children in tones that fall into $this_band$. Regulations make Amazon responsible to report this to the authorities or face financial penalties."

Today, folks are being deported from this country after living here for a decade under the Dream Act. So, no, I don't put much stock in your assertion that things won't be applied retroactively or used to "forecast outcomes".

> We don't have sensitive conversations in the living room

Wow. That seems like an amazing commitment. Do you have a SCIF where you discuss your bank statement with your SO?

Given the Equifax leaks, you might reconsider if your bank statements aren't reasonably public information.

The article puts it well:

> Although the Echo brings about questions of privacy with its 'always listening' microphones, many of us walk around with trackable microphones in our pockets without a second thought.

I guess you didn't give a second thought either (unless you don't have a phone?)

> I would never have one of these devices in my home, and I'm surprised I see so many of them in homes of people who are in the tech industry.

I'm sure you have a vastly more powerful and easier to compromise device in your pocket that you carry everywhere. I have an Echo and it's pretty good for what it does -- for the simple convenience I use it for it's worth it. I have it behind a firewall.

You're surprised that people in tech industry aren't afraid of technology? Because I'm in technology, I'm pretty comfortable with it. I know that most of this fear mongering is pretty baseless; I can review the traffic on my network to see nothing nefarious is happening.

Phones, tablets and laptops also have microphones. Do you have any of those in your home?

> I see so many of them in homes of people who are in the tech industry.

I resisted having one until everyone in my house started turning on their "assistant"s...

I have 4 smartphones in my home, all with assistants running and listening continuously (plus guests' smartphones). It's no longer "it might be listening" but "we told it to listen".

I noticed after a few months of this that I kept forgetting there were devices listening on in the house (and sensing things).

Alexa, partly with its physical presence and partly with its frequent false positives, is an excellent reminder (to you but also to your house guests) that something(s) is listening in on you.

The next best one is Google's AIY Voice Kit where you can so very easily keep the red led button always-on.

Many of us carry around an internet-connected mic and GPS tracking device in our pockets all day, and seem to be ok with that. What's the additional problem with a standalone in-home device that does the same thing?

At the end of the day I'm trusting that Google/Sony won't start listening to everything that happens near my phone all the time. I'm trusting that when I leave my phone on my desk to charge, my co-workers won't tamper with it.

With something like an Echo, I'm similarly trusting Amazon not to listen in all the time. And to compromise it, you'd need to be in my home, physically messing with it for at minimum several minutes without my knowledge.

Humans are really bad at risk assessment.

Correction: Amazon Australia, which ships some items to New Zealand, just launched literally a few days ago :)

I had a look at Alexa availability a few months back and while none ship here to the US, I'm sure there are those who import plus freight forwarding could get one. Just depends how keen you are really.

Do you have a smartphone in the house?

You know, that thing with a microphone and an always-on data connection.

The thing with a microphone - yes; but definitely not with an always-on data connection. I only turn that on when I actually need it; same with GPS and wifi.

So that it can just buffer up the recordings and upload it when you turn data on?

Yes, however that is far more limited scenario - it's much easier to notice that free space on my phone is disappearing. And that space is not limitless anyway, so after certain period of time it'd have to either drop old recordings or stop making new ones.

Ah so there will now only be a reduced chance that your incriminating speech will be uploaded. That's OK then.

I wonder how the microphone on an Alexa compares to my smartphone.

But either way, smartphones can be rooted (for example with LineageOS), Alexa seems a lot more closed than a smartphone.

So did you personally audit the code of you phone or do you just trust that it is not spying on you?

Reply on news.ycombinator.com