Hacker News Reader

Comment by chaboud | Hacker News Reader

Disclosure: I'm an Amazon Devices PE, but not on Alexa devices.

Jeff (and others) have spoken publicly about this in the past, and this teardown is correct. The hardware is designed such that, if the privacy LED is on, the microphone is unpowered. In order to compromise that, one would need to physically alter/damage the hardware.

View on HN

Why not physical debounce switch? I get it is more expensive but no one would question it twice.

What’s wrong with their solution / implemention? Why do they have to defend against a tear down?

The design allows the SOC to unmute via software. This is a significant security vulnerability.

Yes the light will turn off, but who constantly monitors the lights on their devices?

So I guess this calls for a led monitor project!

In order to use a physical debounce switch, there are several steep challenges. You can imagine OP presenting to an audience of 14 people at Amazon Devices group with a slide titled "New BOM proposal" entailing 6 million devices x [$0.0273 (switch price at 100k qty) + $0.05 assembly cost] + $50k engineering NRE (650 engineering hours) + $35k tooling NRE + $22k FCC re-cert + 7k ESD cert + another $100k in various certifications from continental EU, JP, Australia, UK and Brazil. At the end, OP has to say "We love our customers, don't we?" followed by an awkward silence. RIP OP.

OP should also Insist On The Highest Standards and remind them that OP is Right, A Lot.

Then OP sees newsflash on TechCrunch "Amazon Echo Flex v2 is failing in low humidity conditions". Goddamn it, Andrew (at the reliability lab). OP goes home and opens a bottle of Amazon basics wine.

This comment along with your previous one give the impression that in effect any solution that is favorable for the user is not only going to "cost too much to do just for the customers" but is also bound to be less reliable. It's how every privacy invasion or abuse of position of the past decade+ has been justified: "we made the product cheaper and better for you, any change will cost a lot and break it".

Because yes, this can be used to justify close to anything that is in the interest of the company even if it's to the customer's disadvantage. Those features usually bring money to a company so removing them would be a loss. On top of that you can always attach that generic claim that any change will cause the system to implode and will also make your cat feral.

Well, some of that may be true but it doesn't mean we should use it as a justification to keep doing things like that. Products can be built with the consumer's best interest in mind at little additional cost if any. The problem is the consumer's best interest usually brings in less money.

Sometimes it gets absurd. You can hardly buy any modern laptop with a hardware camera switch. It's as if laptop manufacturers were completely blind what number of people uses a hardware solution in order to render their laptop cameras unusable when they want it. The same group of people would love to be able to do the same with their built-in mics (not just in laptops, but also phones). We're not talking about clueless folks but all kinds of people, including tech-aware ones like Zuckerberg. Nevertheless, mobile device manufacturers remain deaf and pretend the problem doesn't exist. And Librem is the exception that proves the rule.

You'd make this change alongside others that would require recertification and retooling anyway, and presumably a lot of those engineers have a full-time contract so that's not an additional cost. Overall assembly cost may be higher or lower depending on those other changes. It really is just that $0.0273 for the switch, which compared to the very steep marketing and branding challenge of convincing privacy-minded folks that Amazon isn't evil, is nothing.

I love how people on HN can rationalize every imaginable bad thing, and figure out reasons why the good thing is really, truly impossible. Qwerty is superior to any alternative, healthcare in the US is completely rational, we can't build cheap tunnels but at least we build the best tunnels, English spelling is a feature not a bug, as are Imperial units by the way, and college education is optimally priced.

I agree with you on excluding certification costs if you’re going to respin the device anyway, but part, assembly, and NRE labor are real costs of this change.

Which should remind companies releasing similar products in the future that it's cheaper to design them with built-in privacy features rather than patch them as an afterthought.

You're absolutely right.

That said, I think companies also have to consider the saleability of privacy features. How many Echos would you, personally, buy if they had a mechanical switch? How many people do you think would make the same decision? How does this stack up against the change in failure rates from a physical switch?

Again, you're completely correct. It's cheaper to design in privacy features up front. I can see some wrinkles that make the question more subtle, though.

Engineers, with contracts or not, have about 2200-2500 hours to spend per year. Those hours can presumably be allocated to this task (that doesn't add any new capability) or to a task that adds capabilities (which will bring in new revenue).

2200-2500h? Where did you pull that number from? That's like 6 days per week with no vacation.

Clearly it does add a new capability: it gives people an additional assurance that the mic is muted in a tamper-proof way whenever the switch is toggled, which is something that according to the article many are currently wary of.

>It really is just that $0.0273 for the switch, which compared to the very steep marketing and branding challenge of convincing privacy-minded folks that Amazon isn't evil, is nothing.

Looking at this thread, there is no amount of money nor action they could take that would convince people here to buy an echo, so honestly why bother?

It's $0.11 per device. If the change was merged with another batch of changes, it would be just the $0.07 for switch + assembly.

Isn't that all back of the sofa change for Amazon, though? Less than a cent per device is still a fraction of what it costs overall.

You could use this logic to shun literally any improvement to the device not done in software.

There'd be no point: a suspicious end user would still need to test/dismantle the doodad connected to the power lines to see that it behaves as expected and doesn't contain anything nefarious. So might as well use a relatively standard electronics design.

AFAIK a reboot would trigger a reset from mic off to mic on. If true that is a very poor choice for a privacy switch.

Also a minor hardware re-design may change mic switch behaviour in the future without that change being noticeable to the buyer. You'd really need regular tear-downs of a sufficient sample-size of devices to make sure that you can actually trust newly bought devices with sufficiently high confidence.

It depends how paranoid you are. If you believe your audio is so valuable that Amazon would create a separate hardware model for you and those like you, and would succeed in keeping that a secret, then yeah you still shouldn't buy an Echo. You will also not want any other always-on devices with microphones and network connections, like a phone or laptop. 99.9% people are not in this category.

I think you may not be worried about targeted attack here necessarily.

Suppose for example that Amazon wants to know how many people talk about some topic or brand, and wants to sell that information, but they think that the mute switch will get in the way of collecting the data.

All it would take is a relatively small sample - maybe 1/1000 Alexas randomly built in such a way that the mic can't be muted - and they would be able to sell these aggregated statistics with reasonable confidence intervals.

Not that I think this is happening, but it is a possible reason I might not trust a single teardown, and it doesn't require worrying about a targeted attack against me personally.

Presumably the threat isn't a targeted attack by Amazon, but rather that the the hardware mute will get 'value engineered' away in the future to save money.

My Echo Studio preserves the mute state on reboot (I just tried it -- I usually keep it muted since I mostly just use it as a smart speaker for Spotify). So I don't know if that makes it more safe or less safe if the mute state can be set either way by the software

What’s the PE in “Amazon Devices PE” stand for?

My random guess would be "product engineer [1].

[1] https://en.wikipedia.org/wiki/Product_engineering

Sorry for the jump straight to the abbreviation. "PE" stands for "Principal Engineer".

Amazon's Software Engineer level progression is:

SDE1->SDE2->SDE3->PE->SPE (Senior Principal, Director Level)->DE (Distinguished Engineer, VP Level).

> The SOC (system on chip) controller seems to be connected to the flip flop resets, which makes sense as the product powers on with the microphone enabled as default....

To compromise it, one just needs control of the SOC (which Amazon has) to turn the light off and the mics back on.

Your statement really isn't any different than saying "Amazon says the mute button is real".

Which we already knew.

The problem is that many people don't trust the good faith of the company you work for, and by extension they won't trust you either.

If you don't trust the mute button, don't buy an Echo.

Many people trust this "word of mouth" way of telling stories, but for those who know rhetorics this pattern should raise a warning. (it is not my intention to accuse, just doing some rhetoric deconstruction) The "so the teardown is correct" part is backwards. Calling the billionaire ceo by his first name tries to create an aura of personal knowledge. At the core it is an argumentum ab auctoritate. Honestly this is worse than "amazon said so" because it is veiled.

You very clearly are not the target audience for this device.

Do you know if the same is true of the microphone button on the FireStick remote? Been debating with myself whether to remove the mic from it.

Which “Jeff” are you referring to here, and if it’s Bezos, why are you using his first name as if we all hang out with him on a regular basis?

THERE CAN BE ONLY ONE. (Too bad it's not me.)

Maybe in company he is referred on first name basis. In my company we always refer CEO by first name, even when we had never met him personally.

Strangely enough, it is totally normal at Amazon to simply call Jeff Bezos "Jeff".

He even has the jeff@ email address.

Reply on news.ycombinator.com