Hacker News Reader

> I mentioned that Chad's flag is identical to the Romanian flag.

I find this unconvincing evidence because: you already knew this (somehow) and found it an interesting piece of trivia to bring up at that time. It's unsurprising, then, that a YouTube channel also finds it interesting.

It's very likely that you were influenced to remember this piece of trivia because of something you observed, like (for example) subconsciously spotting an advert.

These are common advertisements. You only noticed them the next day because you talked about them the previous day.

Conversation at the dinner table often leads to loose tangents. I'll be unable to convince _you_ that this is a subject that had no recent online evidence, but _I'm_ sufficiently convinced knowing the whole situation and aware of what information _is_ shared.

>I am 100% convinced that our phones are listening for keywords and assigning us to categories based on that.

I'm unconvinced. If this is happening to everyone, surely it's possible to conduct a randomized controlled trial? Despite that, we only have years of anecdotes but zero such trials. Moreover, this directly goes against the security models of both android and ios, which both require microphone permissions for apps to listen in on stuff. ios goes one step further and puts a recording indicator when the microphone is in use, so it's hard to imagine how these apps are are even listening in the first place.

The wife gives everything every permission it wants. She has no interest in protecting "privacy", the concept is meaningless to her. She wants Facebook and games and icon packs. How could installing an icon pack be "dangerous"?!? I'm the bad guy for mentioning it.

Her phone is a Samsung A50 probably Android 10 or 11.

> we only have years of anecdotes but zero such trials.

There's some quip about lack of evidence not equating evidence of lacking. But more importantly: at some point the quantity of individual anecdotes, along with the technical ability and interest of the parties involved, become data in and of itself.

>There's some quip about lack of evidence not equating evidence of lacking.

It's not, but the burden of proof is still there. It's up to the claimant to prove that some activity exists, not for it to be assumed to be true and for others to prove it's false.

>But more importantly: at some point the quantity of individual anecdotes, along with the technical ability and interest of the parties involved, become data in and of itself.

Ever heard of the saying "the plural of anecdote is not data"? I think this applies here. Specifically, I think this sort of phenomena is highly susceptible to publication bias/p-hacking. ie. you only remember/hear about all the instances that confirms this theory, but not all the instances where nothing happened. With billions of facebook/google users worldwide, and dozens of possible "topics" being generated per day, I'd expect millions of anecdotes to surface just by random luck alone.

Finally, if we're going by "a lot of anecdotes is proof in and of itself", what does this say about other paranormal phenomena? eg. ghosts or bigfoot? Those have a lot of anecdotes as well.

  > It's not, but the burden of proof is still there. It's up
  > to the claimant to prove that some activity exists, not for
  > it to be assumed to be true and for others to prove it's false.

Of course, and I claim no proof. But we have no proof of gravity either, only very strong suspicion supported by loads of experimental data. Leaking a single keyword per day or per week would greatly enhance such systems' capabilities yet remain very very difficult to detect. Perhaps 52 new keywords per year is enough for them.

>But we have no proof of gravity either, only very strong suspicion supported by loads of experimental data.

Isn't that the difference between gravity and "facebook is surreptitiously listening to our conversations", that the former has loads of high quality evidence backing it up and can be trivially demonstrated and the latter doesn't? If someone claimed there was an invisible force that we don't know about, but you can't demonstrate it and the only evidence we have of it is various anecdotes, I'd be skeptical as well.

>Leaking a single keyword per day or per week would greatly enhance such systems' capabilities yet remain very very difficult to detect. Perhaps 52 new keywords per year is enough for them.

I suspect you're getting some of the threads mixed up. Other commenters have mentioned about this sort of activity being detectable via network monitoring, but I never made such claim. Instead, I claimed that such activity would be detectable by the operating system itself, due to the microphone activity indicators. That's not something you can sneak one word at a time, because you need to be listening all the time to pick up keywords.

If this was a widespread practice, don’t you think we'd have found hard evidence by now? That’s an awful lot of audio data to constantly process or upload, and as locked down as some modern devices are, we still have wireshark, iOS jailbreaks, and rooted Android phones. And, we have security researchers and other curious hacker-types who are constantly probing for stuff.

I think that enough anecdotes do add up to data. Hard evidence? Until a corporate Snowden comes along we may never know, just as we suspected similar things about government surveillance but had no hard evidence until Snowden surfaced.

Those anecdotes can also be explained by psychological factors.

PRISM was operating at the network level, as opposed to widely-available consumer devices. It's the difference between tapping a phone line at the call center, and going into every individual person's house and planting a bug under their counter.

It's more like the difference between tapping a phone line at the call center, and giving into every individual person a handheld entertainment and communication device that also functions as a bug.

It should be extremely trivial to show that some data is traversing the network you fully control.

While I would understand refusal to do so from non-technical crowd (e.g /r/technology or similar cesspolls), it's very difficult for me to understand this argument on hackernews.

> It should be extremely trivial to show that some data is traversing the network you fully control.

I obviously agree with you as the GGP, but the logical counterargument would be, these phones upload so much data in the normal case that it's hard to know what's what. And all of it is encrypted with https, often with certificate pinning.

But, well, audio files are really quite large, at least in the quantities we're discussing. And so in order for the data transfer to go unnoticed, the phone would have to be processing it locally, to decide what to upload. That would be a lot of work, in terms of cpu usage and battery life, and that, again, should have caught some researcher's attention.

Suffice to say, while I don't think any of this is feasible today, this is why locked-down devices and certificate pinning scare me. Audio is expensive, but you can learn a lot with a keylogger.

As the Twitter thread says this has been debunked many times. People have been sniffing traffic for years trying to find evidence of this. However, the point of the thread is that they don't need to since they have other, possibly more sinister, ways to target you.

Other ways of targeting may yield other results, but surely there is value in verbal keywords as well.

In fact, not only keywords but even by just knowing verbal habits such as phrases used, frequency of curse words, accents, etc, could be very valuable in targeted marketing. The couple who regularly say phrases such as "please prepare the tea, dear" may be better to target different ads to than the couple which regularly say "wazzup dog".

Yes, but when you can get similar results using completely "legal" methods that people, even when confronted with straight facts like this, don't seem to care about - why would you risk it?

Did the US government use completely "legal" wiretapping methods?

And their is nothing illegal about listening for keywords, even if the companies currently deny doing so. There really is no risk: The people up in arms about privacy will remain up in arms, and the 99% who don't care will continue not caring.

My wife, I, and some of our friends have also had this sort of gut feeling. However, I suspect it's a combination of selective memory (how many thousand random things have been thrown at you by advertising/YouTube suggestions in the past couple months?) and data mining being scarily more effective than we suspect.

Maybe the sorts of things or the pace of your web browsing early in the morning indicates grogginess. Maybe the machine learning has even picked up on some pattern like insomniacs clicking on a higher percentage of war and poverty news stories vs. celebrity gossip stories. It's also possible the ML has also used your browsing habits to pick up on the cause of your insomnia, while you think the advertising is due to your speaking about its symptoms.

Also, there's a bandwidth/battery life tradeoff associated with 24/7 sophisticated voice conversation tracking. It would certainly take a lot of bandwidth to send everything to Google, and the amount of processing power to filter for conversations about thousands of potential advertising products is significantly more than just listening for "Hey Siri". This is especially true of the amount of semantic processing to know that, unlike 99% of the mentions of "Chad" in English (and maybe Romanian) conversation, "Chad" isn't referring to the dude down the hall who makes a mean quinoa ceviche. I would expect that the kind of sophisticated processing we're talking about would kill a phone battery pretty quickly, and offloading it to the cloud would cause operators to start complaining about the bandwidth usage. Though, I could be wrong.

Edit: so, I think something spooky is going on, but I suspect that machine learning is sometimes just spookily accurate. I think it's Target that mixes in other coupons with baby product coupons when its ML has figured out a woman is 2 months ahead of giving birth, to make it seem less spooky.

Yes, the sleeping pills are far easier to find mundane explanations for than the Flag video suggestion. Either one individually could be a fluke. But together a pattern is beginning to emerge.

I mean, I'm pretty sure we know our phones aren't listening. We have privacy controls for microphone access and people are checking this stuff pretty regularly because they're scared of it too.

If that video about flags appeared when you hadn't talked about flags would you have thought about it? Probably not. You only made a note of it because you'd talked about flags and it "confirmed" your suspicions about phones listening to us.

What initially led you to talk about flags? Was flags something you'd actually looked at before? Maybe, but again you probably never thought anything of it and you probably can't remember whether you did or not. But youtube would remember.

Advertisers also use so many different things about you. They estimate or know your age, interests, location, eating habits, etc.

Without a doubt I have an interest in history and an interest in geography, and Youtube knows that. It is the timing and the specificity that is so suspect. This video was also not from one of the few channels that I watch, though obviously it has content of a similar genre.

I'm sure that smart TVs in particular are definitely listening.

From the original twitter thread posted here on HN as link for discussion:

> First of all, your social media apps are not listening to you. This is a conspiracy theory. It's been debunked over and over again.

But frankly they don't need to because everything else you give them unthinkingly is way cheaper and way more powerful.

Wouldn't it be possible that the wife looked up the flag topic on Google after the discussion and that it got mixed up as both devices shared the same (external) IP during that time? And because of that you got this suggestion? Just playing devils advocate here.

That is completely possible, and I did ask her. She, and the kids, say that they hadn't.

And honestly, I don't think that they had anyway. Maybe one of the kids will take an interest in dad's boring facts about the world at dinner, but the wife has long since stopped even listening!

> I am 100% convinced that our phones are listening for keywords and assigning us to categories based on that.

If would like to defend yourself, consider Librem 5 or Pinephone, which have hardware kill switches for microphone and other things.

Thank you.

I think you're not off the mark a lot.

I do think there's a lot of assumed knowledge gathered from your actions... my computers don't have microphones and I keep my phone in a box when I sleep (because I am that paranoid), but I started getting those when I switched from a day job to a night job.... being online on your off hours may class you as "having trouble sleeping"

A lot of people here are saying this isn't the case, that seeing seemingly targeted ads for things you discussed in the presence of a phone is just a coincidence. I've also read a few articles about this, and their conclusion is the same, so I guess it's common knowledge.

What I always wonder is: why not? We have the technology to recognize keywords in speech, the ability to passively identify handsets, and we certainly have the technology to target ads to people based on keywords. Unless there is no money to be made doing it, why the hell wouldn't your phone be overhearing your conversations and serving ads to you? Is it that we think Google and Apple and Amazon and Facebook and various ad platforms respect our privacy too much to do something that sinister?

Implementation will be hard. Having the mic on all the time drains battery. Storing the data offline and uploading discreetly when the device is plugged in will be discovered quickly. I think on-device voice recognition has come a long way nowadays so with more powerful phones, one of the big companies might try this soon.

It’s exceedingly unlikely to be this kind of conspiracy and far more likely someone from the same IP address looked up related information.

Siri can't even tell if I'm saying "apartment lights" or "Obama lights" when I'm talking directly to it. And if it's not even hard enough to transcribe all the ways all the people across the globe might pronounce words in all of the languages they speak, there's the problem of deriving who said it (was it you or was it the TV?) and deriving what was the expressed sentiment.

It's so much cheaper and technologically easier to parse your browsing history and parsing things you enter in as text than it is to parse voice. Especially when you don't own the platform your software is running on (what would need to happen for Apple to allow Facebook 24/7 access to the iPhone microphone)?

Also, Google/Apple/Amazon/Facebook don't have to respect our privacy, but they do need to respect privacy laws like the GDPR, so they can't actually tap your voice without your consent unless they want to risk actual billion dollar fines.

Some devices have physical kill switches for cameras and mics. Whether or not the eavesdropping theory is true, such devices can help you deal with your immediate worries.

On MacOS there are great tools from objective-see. One of them, OverSight, notifies you when your mic or webcam is activated.

Failing that some tape works quite nicely!

QubesOS allows you to assign certain devices to Xen VMs , compartmentalising your hardware. No spying if there is audio/video device (a Xen hypervisor escape not withstanding) available to the guest OS.

I do like devices with physical kill switches. Some USB sticks and devices by Purism.