Smart devices a privacy nightmare, Amazon Alexa, Google Home worst offenders

Metadata about someone's sexual activity is super-valuable to advertisers. Categories of services and products are too many to list here, but they include prophylactics, ED medications, STI medications and treatments, sex toys, pregnancy and maternity products such as pillows, stretch mark cream, pregnancy tests, and ovulation tests, private investigators, couples therapists, divorce lawyers, etc., etc.

As part of my job I interview a lot of candidates from FAANG companies. That's included several who have worked on Google Home and Amazon Alexa.

I've learned that on those teams someone's always trying to "innovate" with what they can do with an "always-listening" microphone. Lots of ideas go over the line of creepiness/invasiveness, but then the product management tries to come up with ways to make it "okay" again. "Well it's for their own good. What if one of these noises sounds like someone's in distress? Wouldn't it be super-helpful if we could save someone's life by calling 911 for them?"

At the very least some of these features have included trying to categorize types of noises and collect telemetry on them. When they happened, how long they happened for, and so forth. With an always-on microphone, there's no harm in just collecting metadata on when and how often noises that may or may not be related to sexual activity happen, right?

Any incidental information about identified voiceprints or locations that phones report won't be correlated by any human being, of course, but don't be surprised when someone starts getting ads for private investigators and divorce lawyers.

Speaking of divorce lawyers, I can think of some metadata for which they'd probably be thinking about a subpoena or two.

We've noticed in the last few weeks that the Google Home that we have in the living room is "responding" a lot more frequently to random phrases from either real family members, or on TV shows and movies. It use to reliable require the "hey google" key phrase, but now it will spontaneously blurt something with no prompting. About 50% of the time it will randomly give a creepy "I'm sorry, I can't help you with that." and 50% it will start reading some Wikipedia entry.

I know I should probably unplug them...

Consumers just do not care about privacy. I talk to people every day who have essentially given up on even trying to protect their data from the Amazons of the world. I work in a secure environment, but I also know that about half of my under-30yo staff are on tictok the moment they get home. Alexa is listening in to every word of their personal lives 24/7. They just don't care. They think they have nothing to hide. Worse yet, anyone who suggests even a modicum of security hygiene, Signal over WhatsApp, is looked at like some sort of deviant.

Then their laptop gets stolen or their cloud account hacked and they are crying as their pictures are all over some website. But a month later they are back in exactly the same patterns. "But I have 2FA turned on now. It won't happen again."

I would have been shocked if it was otherwise. As a privacy-minded person, I've tried to tell friends and family that this kind of device was likely selling their data for years. People mostly don't care, despite many of them not really getting much out of the devices. Like most people I know who have bought an Amazon Echo will usually have one use case they find convenient or impressive, like asking it to play music, and seem to have stopped using it a month later, but it's still sitting there in their home.

Don't get me wrong, I'm sure there are people for whom an always-on voice interface could be an amazing product, but I think far fewer people than would actually use it are impressed by a demo enough to buy it. It's not crazy to me that the average person doesn't understand the systemic implications of being under constant surveillance, but it does surprise me how effective "cool gadget" marketing is on people who don't really get much out of them

The surprising tidbit here is that Amazon is significantly worse than Google.

> You pay twice, first with your wallet, then with data

It's actually the same transaction. These devices are sold at a loss, the remained recouped through data brokerage or associated sales. For example, the Amazon tablet is in the region of $60. Materials cost alone would be $200+. Amazon expects you to buy books to read on the device, or use Prime video, or whatnot. These devices are notoriously difficult to root (hardware modification) for this reason.

> This extensive data collection poses risks to user privacy and can be exploited for targeted advertising or, if mishandled, for malicious purposes.

Everyone knows Amazon and Google collect insane levels of data, but from a "level of concern" standpoint, Amazon and Google's data collection is 10 times better than all of the random IoT devices that are sending data overseas or to companies that pay bottom dollar for their cybersecurity and infrastructure teams. The risk of that data being "mishandled" is so much higher.

Yes, it would be great if overall data collection was lower, but with Google or Amazon many consumers are fine with gaining the usefulness of the smart assistant in exchange for letting AMZN/GOOG reap the ad tracking potential, but with the ability to trust that the brand won't mishandle their data by letting it fall into the hands of attackers.

The zigbee devices are more expensive and you require a home hub to use them but you can avoid a lot of the problems with the big tech privacy invasion by using them. Maybe the Matter standard will finally get some adoption and we end up with wifi capable devices too but these privacy defending smart solutions are the way to go, even if ultimately they are a bit harder to setup and find.

Weird how Apple is neither mentioned in the article or (the first dozen) comments here.

Yeah that's why I got homepod minis. Despite the fact that Siri is pretty useless and I hardly have other apple hardware. I mainly use it to control home assistant.

I hope there'll be a real local self hosted solution at some point though. Something like rhasspy but simple.