Hacker News Reader

Comment by ghostpepper | Hacker News Reader

"They found that all of the apps they tested occasionally gather raw audio data while mute is activated, with one popular app gathering information and delivering data to its server at the same rate regardless of whether the microphone is muted or not."

The way I read that is, only one of the apps actually sends audio data to the server when the mic is muted. I'm not sure why they don't say which one, and I'm not sure what is meant by "occasionally gather raw audio data" but it could be as innocuous as the mute button not updating and a half second of audio being sent before muting starts. Nobody is building a machine learning profile out of that.

The real story here should be that one app where the mute button doesn't actually work. The others are all operating normally as far as I can tell.

View on HN

> I'm not sure why they don't say which one

Yeah, that's very annoying.

Zoom, for example, will tell you, when you are muted and you begin to speak. It's a very nice thing.

I have a microphone (that wasn't expensive) that has a hardware mute. I use it when I really want to make sure I'm not heard, even for "speaking" detection.

> Zoom, for example, will tell you, when you are muted and you begin to speak

MS Teams has that feature too.

TBH I'm not surprised: when you mute the mic in an app, you're still letting the app in control. If you really want to be safe, you need to mute at OS level or in hardware. That's why cameras have a hardware cover in modern laptops.

Precisely, this is why I think the earlier comment's suggestion:

> How about we not make the default that companies can do whatever they want and users have to take steps like a hardware-muted mic (which isn't always an option) to ensure a basic expectation of privacy?

Sounds nice on the surface, but is ultimately silly. Sure, it'd be nice if everyone did the right thing, but you can never guarantee that, and hence if you really care you need to perform the mute at a lower level than what the app has access to.

Well, I have hardware buttons, too. But without some basic trust, this society could not operate anymore.

And the increasingly (or is it just perceived?) shady behavior of big companies are not helping.

>But without some basic trust, this society could not operate anymore.

I am afraid this eludes our leaders across the board.

The apps can control the sound devices at the OS level too. But fortunately most(/all) don't, so muting in the sound server / OS is generally safe.

MacBook pros already have a mute-speaker button.

It would be so nice to have a mute-mic button which lights up when muted.

Ironically this is a good use case for a Touch Bar: a button on your keyboard that is only there _sometimes_ because it’s only needed in certain contexts (when you’re on a call)

The touch bar is like an idea that works really well in your head. It has so many theoretical cool uses. But in reality I end up never using it for anything.. I would have been happy if the new one had the touch bar and the function keys, but that would have been extra cost for a feature people just aren't using.

After using a stream deck for some odd automation, I think the real flaw was having the touch bar be so contextual, and replacing the existing function keys. Had both existed, and and allowed the user to extend their customisation; say buttons for common actions, siri suggestions, shortcuts it may have been perceived differently, and more of power user tool.

Most of the actions just duplicated existing UI elements.

I think one thing that makes an external stream deck work, is that it is a separate context sensitive device, that is mentally separated from the keyboard.

So when you go to the deck to perform an action, you mentally context switch away from the keyboard, so your brain is looking for different clues.

So even with a touch bar + function keys, the function keys stay in keyboard context, but the touch bar requires that switch in any case. Maybe taking your eyes to the touch bar is enough of a context switch, mentally.

It’s nice in theory for so many things (my favorite is choosing characters when typing in Japanese) but almost never overcomes the friction of using a third input device. I was somewhat of a proponent of it until I got a desktop, then I was happy to ditch it and have a consistent keyboard for desktop and laptop.

I liked the touch bar..

The problem was that it was too much of a tradeoff. Either a touch bar or function keys. I need function keys. The touch bar was useless for this purpose (no tactile feel).

Apple could easily have done both. There's more than enough space even on the 13" macbooks. It would have taken a bit of space from the vertical range of the touchpad but it's already comically large anyway.

It might be but not really.

I carefully made sure I didn't mention the touch bar. I waited until 2022 to finally be able to buy a MBP without a touchbar (and with magsafe charger).

I would very much like a physical button with a reassuring tactile feeling to it. Like the mute button on the function keys row.

But then we're back at a software button, not an hw one.

For that you need an actual pro laptop like a lenovo which has mute button and led for Mic

My Dell laptop from work has this feature, there is a mute mic button and it lights up. With my desktop I have a usb mic that has a mute button and a red/green LED to indicate the state.

Quite interestingly the only laptops I've seen with such a feature (button to mute and LED to display the mic is muted) are huawei's matebooks. Some of them also have the camera under a keyboard button, extremely weird angle but when the camera is hidden you can be 100% sure you are not being recorded.

The mic mute button of course works at the OS level but still...

Also controlled by the OS, but many ThinkPad's have such a button and light too.

https://frame.work/ hardware toggles disconnect the built-in microphone and camera from the USB bus.

My ASUS laptop has a dedicated mute mic button, not a key, on top of the keyboard.

> Zoom, for example, will tell you, when you are muted and you begin to speak. It's a very nice thing.

Zoom was discussed 2 months ago in "Why is the Zoom app listening on my microphone when not in a meeting?"

https://news.ycombinator.com/item?id=30266894

There's a weird culture around reporting problems without reporting names. You see it a lot here on HN and occasionally in media. I'll never understand. Why bother talking about corporate misbehavior (or etc) and not back it up with the basic, minimal data you could provide?

Makes claims impossible to falsify, without naming names nobody can poke holes in your analysis.

Or, you know, keeps your ass safe from being sued...

Anybody can sue you at any time for any reason.

For libel and slander cases though, telling the truth is a valid defense.

This view vastly underestimates the ability of a completely wrong party to sue for slander. In the US at least. You see this with pseudoscientific snake oil salesmen all the time.

>Anybody can sue you at any time for any reason.

Which is neither here, nor there, as some are more likely to sue you than others.

>For libel and slander cases though, telling the truth is a valid defense.

Which is neither here, nor there, again. Not everybody wants the hassle of going through a lawsuit or the time and money costs associated, even if they have a "valid defense".

In theory, but assholes often aren’t creative, and justice system is as it always had been, so,

Maybe their research is ongoing, maybe they are afraid of being sued, maybe they'd rather not harm a company so reputation without fully understanding why they do this

So why did they publish the text now then (other than obviously for self-promotion)?

Why not finishing their research first, discussing with lawyers how not get sued, and contacting the company about it so that they can fix it or comment on it, and only then publishing the proper, responsible research that is actually useful to someone?

They state that their findings will be presented at Privacy Enhancing Technologies Symposium in July. So it seems they want to keep some info for that event.

Should i hazard a guess, it would be either Zoom or Teams.

My guess was going to be Google Meets because I suspect this happens in order to pipe audio to their voice to text translation engine they use to offer you the live closed-captioning feature.

As well as, I assume, to archive a text indexable/searchable log of your conversations. I say this latter part based on multiple experiences I've had receiving clearly targeted advertising for topics I make random passing jokes or commentary about in live conversation, but which I've never once searched, click-imprinted, etc. for online. But, this is purely suspicious speculation. The live closed-captioning feature is a real thing and a thing I could absolutely see resulting in Google always sending audio streams to their backend for.

> You see it a lot here on HN and occasionally in media

It makes some sense here on HN where people often post under their real names and want to think carefully before badmouthing a former employer, or otherwise picking a fight.

I agree that journalists have little excuse.

> I agree that journalists have little excuse.

Except wanting anyone, ever to talk to them again about something controversial.

I disagree.

Bob Woodward has gotten PLENTY of high level politicians to talk to him candidly even though he's publishing what they are saying often in an unflattering light.

If someone as famous as the watergate guy can STILL get politicians to talk to him, what does a random journalist have to fear?

I mean, FFS, the gamer nexus guy got newegg to talk to him even after blasting them about ripping him off and letting them know "we are recording everything".

Journalists are acting like a single inkling of a bad word said will lock them out of access to everyone everywhere. The truth is, there are so many journalists out there that one could make a career of asking hard questions and publishing unflattering statements and the STILL would likely not be recognized by most individuals if they asked for an interview.

> Bob Woodward has gotten PLENTY of high level politicians to talk to him candidly even though he's publishing what they are saying often in an unflattering light.

Woodward is absolutely one of the few exceptions, if not the only one.

He publishes on a long timescale with dozens of sources, not a short timescale with one or two.

So everyone knows the story will come out but not immediately, and everyone knows everyone talks to Bob.

But like it or not, most (not all) of the people he talks to have less to lose, because they are at or close to the apex of power in DC; there will always be jobs for them elsewhere in the USA, in a thinktank or on a board somewhere.

(It's also worth noting that Woodward's most famous source was anonymous for essentially his entire life)

In the real world outside seats of government, talking to a journalist on the record about stuff you should not often means you are the single source -- the only person who made the unflattering or damaging story possible, in a story that maybe won't wait even a week to be published.

It puts you out there on your own, gets you fired, makes it difficult to get immediately re-hired, and I suspect for an American with a family in an at-will state makes telling the truth on the record a luxury they can't afford.

The gamer nexus guy? He got a 1-on-entire-team-of-PR-and-customer-service-people interview at a deep-discount computer parts company in their own office to discuss known implications of decisions they deliberately made. THAT's your benchmark?

Nothing about that situation has bearing on whether people first think of safely concealed sources or being publicly dragged through the mud like Chelsea Manning and Edward Snowden before sharing things far more important than entitled rants about customer service for entertainment-related products. My lord.

this is a press release about a new study not a news article

I imagine it's to avoid getting sued by the company behaving poorly. Companies bring lawsuits against good-faith security researchers all the time to try to silence them, so if you were a researcher, why would you expect the one company among the several you researched who's potentially misbehaving to not misbehave by trying to sue you into silence?

I have said negative things about someone's favorite product and then abandoned a thread (not here on this site) because the stream of hate that followed drowned out the original message.

People can be irrationally attached to the things they use.

As a farm kid growing up, you didn't step between two guys arguing the merits of I-H and J-D farm equipment (1970s...)

In their actual paper[1] they identify it as Webex.

[1] https://wiscprivacy.com/papers/vca_mute.pdf

Webex will by default listen for ultrasound emitted by some video conferencing devices for easy stop. If you disable this, does that change the results?

I was suspecting this was webex, I use an external audio device (plantronics/polycom Calisto 7200) that has an indicator when the microphone is active. It's only anecdotal, but for me when the webex ultrasound features is activated, the microphone is constantly active as long as webex chat is running. When the ultrasound detection is disabled, the microphone is disabled when not in a meeting. As an aside, this setting was reset recently, but that just seems like the ongoing dark pattern/incompetence of "forgetting" privacy settings between software releases.

My understanding is that it activates when you make the Webex Teams/Meeting the application with focus, and should turn off some time after it is no longer the active application, I think ~60 seconds.

It is doing this for the ultrasonic room detection feature, which can be turned off.

> The way I read that is, only one of the apps actually sends audio data to the server when the mic is muted

You're reading it incorrectly.

The paper outlines that as far as they can tell Webex is not sending audio when the mute button is pressed, but is gain and other parameters, based on this audio. And this has been reported to Webex, and they are investigating.

"occasionally gather raw audio data" could be used to remind you that you're muted when you're trying to talk. I've seen that in either GoToMeeting or Zoom

Reply on news.ycombinator.com