Hacker News Reader

Comment by ma2rten | Hacker News Reader

I don't understand why so many tech-literate people have an issue with that. As I am sure you know, those devices only record your voice and send it to the server when they hear their hotword. The hotword detection has to be done on the device itself for technical reasons (battery and data usage).

Theoretically it's possible that the companies that build those devices lie and actually record you other times. But the same applies to any internet connected device that has a camera and/or microphone, such as pretty much every laptop and mobile phone.

View on HN

Software engineers are right to be scared of these voice assistants.

The problem is that typical sloppy, glitchy software (and hardware) is poised to record your voice and send it somewhere at any time, and that somewhere will play or record this, because that's what all this stuff more-or-less setup to do. It's already happened! Alexas have already "butt dialed" other people (not just amazon's servers)!

Think a bit broader than that. Things can play out of various speakers in your house and influence these voice assistants. Again, advertisements have already triggered voice assistants. Research has shown how it is possible to play voice assistant commands that humans can't hear. These devices are poised and ready to record anything anytime and send it anywhere, or just use your credentials to do anything.

My laptop is different. It does have a webcam and a microphone, and straight-up locally installed malware could take advantage. But it's not quite the boulder-atop-cliff situation of the voice assistants. I've never enabled Siri, I've disabled it everywhere possible, I don't install junk software, I often check on things in Activity Manager because freakin web apps use so much memory/cpu/network these days, so I would notice. The webcam has a light which is hack-able but it's pretty hard. My phone has Bixby but I've never enabled it, I've never clicked "I agree", I've disabled the button and the swipe activation and the background services which I am able to without rooting the device. It's in reasonable shape.

Something kind of eye-opening for me was that I recently found an Android setting to make my phone (a OnePlus 5T) vibrate whenever any app requests location data, and even with location access denied to everything, it still vibrates about once every ten or fifteen minutes. As an end user I'm helpless to know whether it's a normal function of the OS, or if I have malware, or if it's Google, or OnePlus, or the Chinese. I can only hope I'm a little fish caught up in someone's advertising scheme and I'm not being tracked by the FBI because I said the wrong mix of things online. (You know, because there's no way I'm getting rid of my smart phone.)

IMO this is a failing of Android that should be dealt with immediately. iOS has had a big red bar across the top of the screen for years when location or microphone is being accessed.

Google relies for a great deal on advertising and gathering user data, unlike Apple. On top of that they don't have tight control over who sells Android devices, nor do they appear interested in doing so. Sadly it doesn't look like they're interested in delivering better data protection for their users.

Google sells their own phones and could introduce hardware driven indicators next to the camera and microphones for when they are on if their goal was not to be evil.

It is a general problem that no one makes strong claims about indicators, so making a software driven camera led is not bad for a manufacturer's reputation.

> Research has shown how it is possible to play voice assistant commands that humans can't hear.

Do you mind linking to the research you're thinking about?

Sure, good idea: https://arxiv.org/pdf/1708.09537.pdf

Aside from the striking similarity to 1984 there is the fact that all of these devices are internet-connected and probably have backdoors or vulnerabilities (so while they might not listen all the time normally, they can be switched to listening all the time if you become targeted). Stallman calls this a "universal backdoor". Most of these devices are always-on and are placed in central positions in your home -- this is not generally true of laptops (mobile phones are carried with you -- but I don't actually have a smartphone for this reason).

Personally I physically disconnect all of the internal microphones from my laptops, and cover the cameras. I wish more people would do the same thing. Purism actually provides physical hardware switches which is much easier-to-use than having to physically take apart your machine (though Purism used to have proprietary kernel drivers, I'm not sure what the current status is).

> Personally I physically disconnect all of the internal microphones from my laptops, and cover the cameras.

How do you deal with the former on your smartphone?

You missed this part: "I don't actually have a smartphone for this reason)."

Good for you, not practical for most of us though.

The Librem 5 will have hardware switches for the microphone and camera I believe. But at the moment I don't have a smartphone (I used to have one but eventually figured out it was a much bigger burden than it was worth).

The device is still analyzing everything and necessarily needs to in order to identify the hot word. It could be doing any type of analysis and do anything with that analysis. It is all closed source so we will never know what it does in our home. And as the technology progresses, it will get better at analyzing, and so will be able to do more analysis and more advanced analysis, and we will then be more comfortable with having this thing in our home, because we will have become accustomed to it.

RMS was smart to call it out at the beginning before it became more powerful.

>As I am sure you know, those devices only record your voice and send it to the server when they hear their hotword.

HAH. Says who?? Are you seriously going to trust companies with a terrible track record and every incentive to do this, are you going to trust them not to use their always on listening device to listen to you? I swear I don't say this to derail the conversation but I literally cannot fathom in my head how you can think like that unless you're a paid shill.

Of those voice assistant companies, what poor track record are you referencing?

It is in the hardware. You can take one apart and see for yourself. These devices will not activate unless they at least think they hear the hotword. Once activated though, nothing is stopping them from staying on. Although Im sure you can just watch their internet traffic to prove if its listening in the moment.

You'd have to do that 24/7 though, if I understand correctly, because these devices can be updated at will.

I understand your point of view if you distrust all Android devices, iPhones and MacBooks. However, most people who say they would never use a smart speaker, happily use their laptop or smart-phone without thinking twice.

Tech literate people know how hard this is to do securely and without bugs. There have already been massive bugs: https://www.washingtonpost.com/news/the-switch/wp/2018/05/24...

Are you unaware of the Google Home Mini hardware bug that caused it to simply send everything you said? The failure modes here are plentiful and catastrophic, and the history of the teams developing these products gives us no reason to think that they're even considering our privacy in their risk profiles.

It's not that I think Amazon et al are listening. It's that that could, or someone who seizes control in an "emergency" could, or someone with "legal authority" could order it.

How is that different from a smartphone or laptop or any other device with a microphone?

Laptops aren't completely controlled by a third party.

Tech-literate people have a better understanding of what could go wrong. And that's even if they trust the creators: those of us who write code know how inevitable bugs are.

These devices are also black boxes. Your laptop, if you're technically literate, is largely an open book as far as what it's up to, should you care to investigate. Granted, your phone less so, but it's also pretty easy to corral if you want to. The entire point of the always-listening assistant is that it's always on, listening. It would be awfully silly to buy one and then unplug it whenever you're not actively talking to it.

Those two categories are not same. Their main goal is listening 24x7.

I don't think you're "tech-literate", seems like you just drank the Kool-aid and sleep well at night.

You used the word "Theoretically" like it's something so remote that's almost impossible which is both dangerously and hilariously not true.

> I don't understand why so many tech-literate people have an issue with that.

Or at least: the ones with a smartphone. What makes this different?

I assume it's the similarity to 1984.

Because it can easily be misused.

For example: Trump is one of those people that can change the US into something you would not imagine a year ago.

It's very easy to say that this wont happen but I also thought Trump would never become a president...

Your first sentence was a good observation. Dragging the specific example of Trump in polarizes the comment. Trump has already been President for over a year and the country has by no stretch seen changes that I could "not imagine."

The biggest lasting impact a president can have is appointment of judges. Congress pretty much has to do the rest, and they even have to approve the judicial appointments.

> Trump has already been President for over a year and the country has by no stretch seen changes that I could "not imagine."

It typically doesn't happen overnight; rather, your rights erode over time, usually in the name of national security. That said, even in his short tenure, I believe Trump has done much to erode the norms of functioning democracy. Just a few examples: threatening political opponents with jail, threatening journalists, and at a very minimum having the appearance of basing foreign policy on how it affects his personal business empire.

>Trump has already been President for over a year and the country has by no stretch seen changes that I could "not imagine."

Well... I for one couldn't imagine a primary channel for communicating American policy being a personal Twitter account.

Reply on news.ycombinator.com