Hacker News Reader

Comment by sroussey | Hacker News Reader

All smart TVs should be disconnected from the internet. Use an AppleTV or similar.

Some TVs will present a popover warning that they have not been able to check for updates for a while, after being disconnected for some time, and you can't close that without letting them connect (even if you are just using the screen to display content from an HDMI slot rather than using any of the other TV features).

Which ones? I'd be happy to know the brands.

Samsung TVs certainly do. A massive PITA.

Good to know. I don't buy Samsung anymore anyway. I have two CRG9s and they're already showing same problems after a couple of years. Had a midrange phone from them some years ago - started dying 6mo in (battery, restarts, slowness).

Be specific. Which models and after what time.

Mine has been running for two years now without insisting on updates.

FWIW, I've never seen that come up on the five or six TCLs that I've owned over the last decade. I have AppleTVs connected to all of them and never connect them to the internet. So far, so good.

I don't recall off the top of my head. It was covered in one of Louis Rossmann's rants so you might find information on the consumer rights wiki he talks about.

Do they still do it if they've never been connected to a network? So they don't even know what date/time it is relative to their current updates/firmware? Do they display the warning based on a cumulative power-on timer only (much as good quality computer displays have somewhere in their menus buried a figure showing their total cumulative power on hours).

I wonder if this is firmware related. I've had a Samsung TV for a few years now that I've never connected to the internet, so my firmware is likely very out of date, and it has never displayed a message like that.

A family has a soundbar that just turns off after a while if it isn't connected to the internet.

Sounds like an intentionally defective product. Just after warranty period ends, TV turns on but won't show my picture. Return it to the store if you live in a place with consumer protections. The warranty period is legally irrelevant in cases like this.

Not sufficient, given reports of TVs and other devices automatically creating mesh networks. Your disconnected TV could talk to your neighbour's connected one. If anything, I wonder why LG isn't already doing it.

Edit: Getting pushback asking for evidence (fair). Most recently I read it in an HN thread a few years back. I thought it was a TCL TV, but I can't find it anymore. It wasn't Samsung's WiFi Direct, which I don't think was ever on by default.

Lacking better evidence, I'll admit I'm probably wrong and no TV has been documented doing this (yet).

Could you link to these reports, the ones with evidence?

https://www.theverge.com/2023/3/28/23659191/amazon-sidewalk-...

That is an article saying that mesh networking frameworks exist. It does not support the GP claim of smart TVs creating mesh networks across different owners.

If something is technically possible, one should act as though it is already happening and hope to be wrong rather than refusing to consider the issue until sufficient “proof” is given, by which it will be too late. Doubly so when advertisers are involved, who as a group are economically-incentivized to not care about consent.

This seems paranoid. There are many things which are technically possible, but there is no evidence of some super-advertiser doing. It's not even clear to me that much of the 'fingerprinting' (past basic re-targeting) actually works.

> This seems paranoid. There are many things which are technically possible, but [...]

Isn't this what people said pre-Snowden? Not that NSA spying is the same as corporate "surveillance capitalism", but if companies can make more money off it and the technology exists, it seems prudent to assume companies are trying it.

There was evidence of the NSA intercepting international communications before Snowden, but for some reason that didn't seem to make much of a lasting impression: https://en.wikipedia.org/wiki/Room_641A

It's also significant to note that while the government is quite bad at keeping 'problematic' behavior secret, companies are much worse at it.

Analogously, there's evidence that companies will make extensive use of available techniques (browser fingerprinting, cookies, etc.) to track and surveil users without their knowledge and often against their will. The exposure of that arguably also hasn't triggered an effective backlash against those companies. So, as with the pre-Snowden evidence for domestic communication interception by the NSA, I think there's ample evidence of the willingness of companies to exploit whatever technologies they can in order to surveil users.

The way this is typically handled is through compartmentalization, where no one working has enough of a global view to be able to claim that the behaviour is problematic.

There's a lot that's problematic that we suspect that is going on but don't have firm proof, because the organization actually is pretty good at keeping it secret enough. There's some exceptions where things do get leaked/revealed, but how would you know if this was 99% of wrongdoing, or 0.99% of it?

This would be trivial to test and detect. Just like every claim that TVs will connect to open WiFi networks if you don't connect them to a network. Yet after years of these claims and being extremely trivial to test not a single shred of evidence has ever been provided.

How would you test this?

If they form a mesh and route traffic via one TV that acts as an exit node you can check the packet TTLs.

Isn't messing with TTLs a pretty obvious thing to do when communicating covertly? And wouldn't that kind of packet inspection only catch cases of TVs literally acting as packet-level routers, but not catch application-layer shenanigans like aggregating statistics in the exit node so that all the data going over your own network appears to be originating from the same device?

It's still implausible, but thoroughly verifying that your TV isn't spying on you isn't trivial.

There's no requirement that the mesh be IP-based or function as a layer-3 router...

Even if it were IP-bsaed, it would be extremely straightforward for one box to send a UDP message to another, and receive and retransmit at the application layer. No TTL nonsense, No multiple IPs showing up communicating upstream.

But if my TV is doing this, then by definition it's not acting as an exit node so how do I test it?

Put a WiFi NIC in monitor mode and see if the TV is connected to another AP based on the 802.11 packets.

Or if this theoretical implementation by a manufacturer is using a custom protocol/frequency (very unlikely for a variety of reasons), you'd begin by probing with an SDR.

Which part of that qualifies as trivial?

I only semi-agree with GP; it's trivial for someone who works in Tech to pull it off, but that's really all you need to blow the lid on the whole operation given manufacturers would likely have implemented the same behavior across all TVs of the same model/product segment.

How do you think? By broadcasting an open WiFi network and seeing if it connects and requests a DHCP Lease.

Here is maybe what he was remembering from HN:

> Our Samsung fridge’s manual says it’ll automatically and silently mesh network with any Samsung TVs in range, use AI and hidden cameras to recognize what’s in the fridge and when we use it, then have the TV inject targeted ads into programming based on its findings. https://news.ycombinator.com/item?id=45742208

Wild. Still, paraphrased like that it triggers my "sure, that totally happened" detectors.

I’ve heard rumors of that, and also of TVs shipping with cellular modems with which to phone home. I don’t know if either have been confirmed, but it would be ridiculous for such a thing to be legal.

Cellular modems seem unlikely, because both they and the service plan they'd need are too expensive to be justified by any benefit to the manufacturer.

Yes. Considering 90%+ of users will just connect their TV to their WiFi, shipping a cell modem with every TV to catch that last 10% seems like bad ROI.

I could however see this happening in the future in response to regulation. For example some "think of the children" rule that makes TV makers responsible for blocking mature content.

Phones already have modems that do Wi-Fi, cellular and Bluetooth in a single chip.

It may at some point no longer be economical to manufacture a Wi-Fi only modem.

Not so far fetched when your advertising revenue is in the tens of millions of dollars.

They just need this revenue by tv to be higher than the price of the mobile plan per tv. For a few Gb per month it may be relevant in the not so distant future.

Cell plans are very cheap when you are a company looking for low bandwidth off-peak service for a lot of devices. As individuals you can't get those deals, but companies can.

I don't know if TVs have a cell modem, but it isn't unreasonable to say they could.

As a different poster mentioned, the FCC needs to know about this though and so it will be documented.

I doubt the modem would cost more than $5 at scale. No idea what sort of off peak data deals you could get at scale but I have to imagine it’s close to being feasible.

You can get special IoT cellphone plans in bulk for something like $1 per device per month, or even less.

It's a longstanding, and obviously false, rumor. It would be trivial to prove that these things connect to open wifi networks to phone home, but no one has ever proved that they do that, because they don't actually do that. It would be a little harder, but still very easy, to prove that they connect to cell networks, but no one has proved that they do that either, because they don't actually do that either.

Keeping them disconnected from wifi is sufficient.

You're all over this thread posting this same thing but you admitted that to you, "trivial" means substantial reverse engineering.

"Trivial" to me means looking up the FCC ID of the device and seeing what kinds of RF emissions it is supposed to radiate.

Or, still trivial (but more expensive): Point a spectrum analyzer at it and see what kinds of RF emissions it actually radiates.

I don't need to open the box to understand what kinds of noises it makes.

Or even just realize that if the devices had this capability these companies couldn't resist using it to show you ads. Since these devices don't show up to date ads unless you manually connect them to a network you can be reasonably sure that they don't have a fallback internet connection.

It’s perfectly legal to put a cellular modem in a TV, but not without disclosing that to the FCC and on product labels. This and the mesh network thing for TVs are (currently) a conspiracy theory, which sucks because it muddies the waters in advance of it inevitably happening in reality.

In the good old USA everything is legal until Congress makes a law, and Congress shall make no law. In the EU it's illegal.

Which manufacturers and which TVs?

Otherwise it's just some 10+ year old rumour

Unless you have evidence, please stop spreading this rumor.

https://www.youtube.com/watch?v=6IFVTcM28KA

Please point me to the timestamp in that video that supports this claim:

> reports of TVs and other devices automatically creating mesh networks. Your disconnected TV could talk to your neighbour's connected one.

https://news.ycombinator.com/item?id=49615448

Sorry but it's up to the vendors to prove that abuse is technologically impossible (through open source software and cryptography). Closed source software should always be assumed to do the worst thing possible.

I'm afraid I can't help you with your paranoia. TVs just simply don't do this. It would be trivial to prove if they did. There's plenty here to be upset about without making up stupid conspiracy theories.

Why do you defend LG?

I'm not.

We've established that your definition of "trivial" involves complete reverse engineering of the firmware...

See: Amazon Sidewalk

I have connected it to my network and then blocked it off the internet via Pi-hole. That way, I hope, it'll not try to scan for other open networks.

It’s still scanning (or at least listening to) all the other devices on your local network, like your phones, PCs, etc. It collects an inventory and if it ever happens to get Internet access, uploads that data.

That's why you put IoT crap into an isolated vlan with its own ssid, enforce device isolation for that ssid across all WAPs, and enforce isolation on the vlan level with your switches to cover any hardwired devices.

That's not really sufficient. It could still phone home if it falls back to IP addresses. You should be blocking it at the firewall level, not just with DNS.

But me personally, I wouldn't ever connect any of these devices to my network.

The only reason it is on my network is that I need it for home automation (via home bridge). I'll have to see what else I can do.

Firewall rule that prevents the tv from accessing the internet (by mac address if using dhcp, or set a static ip for the tv). Or stick it in separate quarantined IoT subnet with your devices.

Some of these devices also now use DoH to bypass any DNS-level filtering.

>All smart TVs should be disconnected from the internet.

Not good enough. The device has sufficient storage for YEARS of conversation data.

You connect it once to update the firmware and boom everything is backfilled. Your neighbor sets up an open SSID? It all gets out.

Just disable wifi. Occasionally factory reset, hook up to wifi for firmware update, then disable again.

Why do you need to update the firmware at all?

“or similar” like what?

Streaming sticks suffer from the exact same problem.

The Apple TV is the only device I know of in this space whose business model is not selling your data to the highest bidder.

Much better than an Apple TV is a Linux machine running Kodi.

Is it better or is it just more libre?

It's better. No content restrictions and more control.

So more libre. But is it also better?

Yeah, I think it's both.

Curious how a PS5 measures on the spyware scale

Part of the issue is many TV's these days are essentially bricked until you connect them to the internet to "activate".

Only if by "essentially bricked" you mean you can't use their "smart" functionality.

All smart TVs should not come with WiFi or Ethernet controllers.

Then they are not smart TVs anymore. More precisely, they couldn't offer the features one expected from such. Think about a smartphone without internet connection.

Reply on news.ycombinator.com