Hacker News Reader

Comment by rpdillon | Hacker News Reader

LG's statement:

> ACR uses audio fingerprinting technology using the TV’s internal audio processor (not a speaker) to identify content and does not collect screenshots, screen recordings, video recordings, voice recordings, or other audio recordings from the TV.

So they are claiming that ACR is done entirely through audio processing, and no visual data from the screen itself is used? That...doesn't seem plausible.

This paper from 2024 investigated both Samsung and LG and found that they both capture screen images for ACR, and send the resulting hash (not the raw content) back to the manufacturer for identification.

https://arxiv.org/html/2409.06203v1

We're going to have to get saavy in pulling apart the distinction between "I look at everything and then send a nice summary back to my manufacturer" and "I send everything back to my manufacturer". As AI gets cheaper and more efficient, it'll be baked into everything, and will distill signal at the edge and send the good bits back to central command. I fear the legalese in the ToS will obscure this new way of "not collecting" user information.

View on HN

> So they are claiming that ACR is done entirely through audio processing, and no visual data from the screen itself is used? That...doesn't seem plausible.

It's probably easier to do and every bit as accurate as just using a screenshot.

And it's still exactly what I don't want them doing. There's literally zero reason for LG to be building an advertising profile on me because I was foolish enough to buy one of their TVs. This isn't something that makes their products better, it's spying.

Here's how it's been done in the past

https://www.cameronmacleod.com/blog/how-does-shazam-work

Audio is a bit easier to turn into a fingerprint for identification vs video. Video has a lot of smaller subtle changes that happen from things like compression which make it a lot harder to identify. It's why youtube still hasn't figured out piracy, but they'll knock you immediately if you play 5 seconds of copyrighted music.

It’s a lot less data to process as well.

wouldn't taking screenshots in fact not always be possible depending on the content you are watching? For example netflix with their hardware level drm? (Although its their TV they possibly have ways around that with some custom hardware)

lg’s display controller has to know what to send to panel

LG sits at exactly the location where screenshots are possible.

Eventually, a digital signal needs to be converted into pixels on a screen. Once that happens, it's trivial to also pipe those pixels into a screenshot.

It's the reason DRM for digital media is pretty dumb IMO. The most sophisticated DRM still has to be decoded at some point for the end user to enjoy it. It can always be broken with a camcorder (though quality suffers). However, there exists devices which decode the HDMI signal so doing a pure digital signals.

I can assure you while out sailing the high seas I have watched many Netflix titles. So their DRM is literally only there to make the experience shittier for the honest customers.

As much as I detest ACR this seems more plausible than screenshots but I wouldn't trust LG regardless.

Audio is much easier to fingerprint and match against content.

To me, it's not even about why they're doing it (building an advertising profile). I don't want them doing it at all, for any reason.

When I buy something from the store, my relationship is between me and the store, for the 30 seconds it takes for me to pay for it. I don't want an ongoing relationship with the device manufacturer. I don't want to be tethered in any way to the manufacturer. I don't want to have an account with the manufacturer. I don't want the device sending anything to the manufacturer, advertising related, telemetry, or even a single bit "user has used your product." Do you get it, manufacturers?? I don't want any kind of relationship with you! I want to purchase my product and use it by myself not with you.

Then what about all the cloud enabled spyware? How would that work? (/sarcasm)

Truly though, smart-home stuff runs the whole gamut of privacy and device manufacturer relationships. eg: I have used three different smart/room AC units:

- one requires its own cloud-enabled app for any remote connectivity, no HomeKit integration - one integrates with HomeKit but then leaves an upgrade hint that can only be done through an app with a login - one integrates with HomeKit and pretty much just works

HomeKit then allows me to remotely control via HomePod/AppleTV acting as a router ... of course this is just a different cloud connectivity but with on-premises devices controlling other on-premises devices.

For each manufacturer of smart devices, there is potentially a separate cloud where data is being funneled through. Some devices support multiple upstreams.

I get that Matter should be a way to fix it but the reality feels more like https://xkcd.com/927/

Part of me just wants dumb devices back. Get rid of buttons on a microwave (just give me a knob for time and maybe another knob for power setting.) Remove touchscreens from cars (mine glares at me with certain sun-angles.) Bring back the desktop/computer hutch and phones that don't live in your pocket. However, having the ability to start cooling my bedroom 45 minutes before I arrive home is ... pretty compelling too.

Manufacturers just need to realize that LANs exist and allow their devices to be used with the Internet turned off.

When I'm sitting in my home and I want to turn off the AC unit in the other room or close my garage door, there's no reason I should have to do an IP roundtrip to the manufacturer's server. Both devices are on my LAN. They should just talk to each other. This has been a solved problem for decades.

I have been toying with the idea of building some kind of "home cloud" that hooks into all of your smart devices (at least all of the open devices that it can), allows photo backups from mobile devices, idk. Stuff like that.

Something you can just scan a QR code with your phone and it hooks it into your backups so your "cloud backup" is sitting in your utility room at home instead of being "someone elses computer"

Obviously this is all achievable by a savvy techie, but I'm thinking along the lines of a black box any idiot can use.

The idea is very appealing to me, I would love to decentralize "the cloud" for your average person.

And if it were possible to get one of these in every house and apartment, then the idea of a "smart home" starts to really click in ways it doesn't right now. Your smart home would have a "home cloud" box that acts as the brain

Idk. I think there's a product idea here somewhere but ultimately it's just something I'm kicking around now and then.

Lowest common denominator? They have to round trip due to various NAT/router/firewall/App BS.

Your average ‘idiot’ can barely get a managed App to work, and that typically requires some kind of cloud endpoint to co-ordinate.

Other stuff is the land of prosumer.

You only need an external server if you want to make it so the end user can access their device remotely. Otherwise, an app can very easily just scan the network for the device. Heck, the app itself could be the thing that sets up the device on the network in the first place.

Remote access should also be do-able without having a manufacturer-run server. We over-complicate things with NAT and with ISPs sabotaging inbound connections to our networks. At least with IPv6 every device on my network is addressable by the outside world, and I can (and should be allowed to) make the decision about whether they are accessible. The device manufacturer should not have to insert themselves into this conversation.

I guess the question is, better or worse?

Remote access without the central server seems to make direct attack easier?

users sometimes end up with some combination of the above:

1) multiple wifi networks 2) ‘guest mode’ wifi networks (you can’t communicate to other devices on the same network) 3) various airplane mode type scenarios where they have cellular but not wifi connections semi-randomly, even on the same property/area.

these all happen with out of the box ISP setups pretty regularly, btw.

and they’ll just blame you for the flakiness.

also, for most of them, they love remote access anyway and don’t want to consider the security implications.

I have a Vizio TV that was advertised as a Chromecast TV, and I got it because of that. It was HDMI and Chromecast only. A few years later they did a silent update that added apps and generally made the UI much slower. I mainly use it with an AppleTV or game consoles, but it still irks me that they completely changed what was in my mind a nearly perfect TV.

Can you factory reset it to the prior state and turn off updates?

(I know this doesn't change what Vizio did, but it might get your perfect device back)

Why was it connected to the network?

Chromecast requires a network

They realize. They hate it and wish it would go away. LAN connectivity makes it really hard to spy on you, inject ads, require subscriptions, and brick perfectly functional devices so you have to buy new ones.

No it doesn’t? They can do all these things just fine over a LAN connection (assuming it routes externally).

If you can firewall your LAN - you can also firewall your WiFi.

Except some of the TVs try to connect to unprotected hotspots, or piggyback through ISP's routers' hidden secondary SSIDs. Which even opens people's data and ambient conversations finding their way to the manufacturer or advertisers through war-driving.

name one.

I think it’s currently a theoretical issue, not a proven one. Do you have any concrete examples?

IMO, the moment a device starts doing that, I’m setting it on fire.

“If you can firewall your LAN - you can also firewall your WiFi.”

Huh? Your WiFi is (part of) your LAN.

That’s what I’m saying, yes.

Ok, I don’t understand your point, then. If a device works locally then you can firewall it and block any nasty stuff phoning home. If it runs everything through the manufacturer’s servers then you can’t firewall it without disabling it entirely.

Read the thread. People are saying ‘if it connects to the LAN it’s safe’.

I’m pointing out safe or not has nothing to do with it being on a LAN or not.

I’m completely lost. I’m not talking about safe, I’m talking about how routing everything though a server gives a lot more control to the manufacturer and they’re loathe to give that up.

I’m pointing out that has literally nothing to do with LAN or Wifi. It’s a problem with having literally any (unfiltered) network access at all. Though even filtered, you’re susceptible to bypass attacks.

Notably, a device can even route all command and control through a cloud service, including sending copies/hashes of all accessed content AND also serve just local (as in physically connected) media/content, if it has a network connection.

This has been an issue since BluRAY at least, where players have the capability to check physical media licensing and deny/brick BluRAY media based on network updates of the keys, and could run Java apps which had network access. So at least 20 years? It is a big reason why there was resistance to BluRAY vs DVD, as DVD was a relatively dumb player.

The only way to prevent that is to firewall off or physically disconnect any network access. Which is getting harder to do with cheap LTE modems.

In this example, for instance, I bet these LG TV’s will happily send all this info even if no one is using any network or app based media streaming at all.

And if everything goes through the manufacturer’s servers then you have to give it internet access for it to work at all. If it works over then LAN then you at least have the option to block it without disabling the functionality.

Again with the ‘works over the LAN’. What do you think that actually means, because I keep explaining that doesn’t mean what you seem to think it does, and then you keep repeating it in a context which doesn’t make any sense.

It means that my device at e.g. 192.168.123.45 can be controlled by my phone or computer at 192.168.123.46 on the same LAN without any of the traffic going over the internet. And since none of the traffic goes over the internet, the device can be completely blocked from internet access without disabling the ability to control it.

I'm not really sure what the disconnect is here. This seems like the obvious meaning of "works over the LAN" and it means, by definition, that you can control the device without letting it access the manufacturer's servers.

You’re saying ‘works behind a firewall’, or ‘works without an internet connection’. Maybe ‘works on a fully isolated LAN or VLAN’?

A LAN (or WiFi) typically has routability to the Internet (though doesn’t have to, of course!) which is why what you are saying is confusing. It has for at least 20 years, and is especially true in residential, but also true even in commercial.

Those some IP addresses could also be NAT’d, and often are.

Most modern products have also spent significant R&D figuring out how to bypass NAT and firewalls and even hide from packet inspection (tunneling DNS and command and control over HTTPS, for one example).

Very few people are able to handle or setup actual air gapped LANs now (or isolated VLANs), but anything besides that is risky in these scenarios.

I was replying to “Manufacturers just need to realize that LANs exist and allow their devices to be used with the Internet turned off.” If it took you this long to figure out what I was talking about, I don’t think it’s really a problem with my description.

So weird, it’s like you refuse to read my comment and keep replying with the part of your comment which ISN’T that part, and then act like I’m the problem when I point out you aren’t making any sense.

Are you real?

Your comments consist of two parts. 1) telling me that I’m wrong because you insist on not understanding what I’m saying 2) a bunch of irrelevant stuff based on not understanding. So yeah, I’m replying to part 1 and ignoring part 2.

So what, praytell, does LAN have to do with your comment. Since I was pointing out, that it was the ‘turn off the internet’ part, not the LAN/Wifi that mattered. And that was the part that you kept ignoring.

What does LAN have to do with my comment about why companies don’t like to let their devices talk directly to my phone/computer when they’re on the same LAN?

Jesus. I give up.

> I don't want an ongoing relationship with the device manufacturer.

I think it depends on the device. If I buy an iPhone, I have the expectation of installing apps on it after purchase, and that necessarily involves a relationship with the app store provider (ie. Apple), not the store I bought the phone from.

With a TV, I suppose it depends on whether I want to install media apps like Prime Video or Netflix on it. I understand that there will be people who don't want that, in which case I agree with you. But others want to be able to run this stuff somehow, whether it's directly on the TV or via some HDMI device like a Chromecast or a Fire Stick. At that point, they _do_ want a relationship with some hardware manufacturer so that the third party app can be delivered to run on the hardware.

> If I buy an iPhone, I have the expectation of installing apps on it after purchase, and that necessarily involves a relationship with the app store provider (ie. Apple)

This is only true because Apple dictates it to be so. The manufacturer of the device should not have a say in what I choose to do with a device I bought. I should be able to install software on a device without asking the manufacturer for permission. Why do they think they should have an opinion? After I purchase the device, it's mine, not theirs. I can throw it off a cliff if I want without asking for Apple's permission, why can't I install software on it?

> At that point, they _do_ want a relationship with some hardware manufacturer so that the third party app can be delivered to run on the hardware.

The device manufacturer should not need to be involved with a user's decision to install software. There should not be this requirement to have a relationship with them. We should never have allowed this idea to be normalized that the device manufacturer needs to be somehow have a say, let alone be the sole path to using the device.

Device manufacturers should sell devices and then get out of the way of what the user is doing with those devices.

I mostly agree, although if the manufacturer has a catalog of software (which they have managed to check for quality, classification, etc) that you can optionally use for installing software (which others can also choose to do, e.g. in the case of Android there is also F-Droid), but that you can also install anything that you want to do by yourself (including software that you wrote by yourself) without needing to be able (or willing) to contact (or have anything further to do with) the manufacturer (for any reason), then it can be helpful.

Also, if someone provides a service (e.g. Netflix) that some might want to use and some might not, then you have the option to use that service might be helpful but even that should not require any relationship with the manufacturer unless they are also providing the service. If the manufacturer is separate then they should not have anything to do with it (e.g. they should not add a button on the remote control specific for Netflix; if they have user programmable buttons that you can add your own labels, then it would be possible to use such a thing like that if the end user decides to install Netflix). (There are other problems with Netflix too but I am ignoring them for now because that would be a separate discussion.)

When I buy a computer, I have the expectation of installing apps on it after purchase, and that doesn't necessitate any relationship at all with any app store provider of any sort (ie. Apple).

(When I buy a pocket supercomputer, I have that same exact expectation. It's often left unsatisfied, but I still have it.)

The trouble is that we haven't figured out a trust model that works when we do exclude that relationship. The traditional Windows "run setup.exe" model is terrible for modern expectations of security. The alternatives available today are still very far behind the safety that ordinary users get today when they do enter a relationship with the manufacturer. Unless you're an expert and not a typical consumer.

So there can only be one extreme or the other extreme?

There's no possible world in which a gate can be installed in the wall of the garden?

What does that gate look like in practice?

A sternly-written, notarized letter of indemnification? A bizarro-world sequence of events (like activating Developer Mode on Android)? A game of Galaga which, if played perfectly, unlocks the gate just as doing so unlocks the black car in Ridge Racer on the PSX?

I don't know. It's a gate that allows a person to leave the garden. It exists to be opened, and to be passed through, and also to be closed again -- or to be left open. :)

(The UAC prompt in Windows is also a gate, if existing work is to be studied.)

I know what a gate is for. My question was trying to get you to explain the middle ground between the extremes. That it is hard to visualize/imagine is kind of my point. The UAC prompt is an excellent example of a potential middle ground that is definitely a gate but a near useless one.

I certainly want the gate. I just acknowledge that some kind of relationship with the hardware manufacturer for the benefit of the ordinary consumer is the best that the technology industry can offer right now.

Skill issue. Especially these days. What a cop out.

> I think it depends on the device. If I buy an iPhone, I have the expectation of installing apps on it after purchase, and that necessarily involves a relationship with the app store provider (ie. Apple)

I bought my Pixel from Google and don't want any relationship with Google whatsover. In fact, I wiped the stock OS and installed Graphene for this reason. My apps come from various sources, none of which is Google.

> If I buy an iPhone, I have the expectation of installing apps on it after purchase, and that necessarily involves a relationship with the app store provider (ie. Apple), not the store I bought the phone from.

That's because Apple supplies both the hardware and the software. Being a software supplier - the only such supplier - they need to keep being involved. This wouldn't be the case if third-party OSes existed for the iPhone - it doesn't need to be the case for M1/M2 MacBooks, for example, thanks to Asahi, or for any x86-based hardware.

They don't need to be involved. They force it on people and people are making a judgement call and a trade off that the upsides outweigh the downsides. That doesn't mean it's right or that people are happy about it or that it needs to happen. That would just be an appeal to the status quo.

Wait your saying it’s not cool if you buy carrots from the grocery store that have embedded sensors so that when you eat them and they pass through you they build a health profile and determine what types of supplements are best to advertise to you?

> There's literally zero reason for LG to be building an advertising profile on me because I was foolish enough to buy one of their TVs.

I feel like the world is bossed by people who read (well, ok listened to a 5 minute summary on a grindlife podcast at 1.5x speed) about the Trojan Horse and thought they smelled a business opporunity.

By and large, that has been my experience.

Is it within fair use to surreptitiously record copyrighted music?

No less than Shazam is?

I’d assume Shazam has specific arrangements with rights holders.

> It's why youtube still hasn't figured out piracy, but they'll knock you immediately if you play 5 seconds of copyrighted music.

Unless the piracy is silent, surely audio fingerprinting would catch it?

> It's why youtube still hasn't figured out piracy Are you sure that's even on their roadmap. If they profit from piracy why would they care.

the whole DMCA/Takedown process is another shenanigan ripe for abuse. Not real copyright enforcement.

> an advertising profile

It's going to be so easy to determine who you voted for, given a record of every TV show and news programme you've watched, to 90% accuracy. Or to determine if you'd be a "corporate culture fit" when you're next looking for a job. Or an apartment. Or to find whether anything matching the hash of some trade secret documents was displayed on your TV (or ever connected to it [1]) - the "advertising" firm will be forced to hand over documents on you through lawsuit discovery and the wonderful 3rd party doctrine.

Have you been watching media associated with "woke subversion"? "Islamic extremism"? "Far-right hate"? "Incitement to subversion of state power" [2]?

They're not building an advertising profile. They're building a profile. Ads are just the most common known use-case at the moment. But the profile will remain long after ads become the least of your concerns. Consider how such a profile would have been used during the cultural revolution.

If the government required you to submit a record of every book you read or own, people would rightly freak out. How is this any different?

[1] LG Smart TVs log USB filenames and viewing info to LG servers - https://news.ycombinator.com/item?id=6759426

[2] Hong Kong's Tiananmen activists sentenced to up to seven years in prison - https://www.bbc.com/news/articles/cvgyvk2djk4o

The difference with the book example is that having to hand over a list of books is tangible whereas technological profiling is extremely subtle and abstract in comparison. As IT professionals it's of course easy to see the ways that this kind of stuff can be abused, whereas the probability that someone outside of the industry or otherwise not interested in computers to be "woke" enough about the digital panopticon is diminishingly rare.

And there's of course also Sinclair's law, so even people who should know better might be either willingly ignorant or just not care if it means that they can maintain their quality of life, moral bankruptcy be damned. Similar arguments can be raised for example with the anthropogenic climate catastrophe or other abhorrent phenomena where there's a big chasm in the knowledge between laymen vs experts.

It is exceedingly difficult to convince someone that something is a problem unless said problem is staring the person in the face.

> So they are claiming that ACR is done entirely through audio processing, and no visual data from the screen itself is used? That...doesn't seem plausible.

Wrong. They claim it doesn't record video. Recording means saving permanently - live processing is not recording. ACR is processing the video output live.

Notice what they don't say at all. ACR is just one type of spying. A completely separate feature records what you say from the microphone. They only claimed ACR doesn't do that, which we knew. They did not claim the TV doesn't do that.

This is a carefully crafted PR statement, to avoid saying any lies while making it sound like the accusation was wrong, but it does not actually say the accusation was wrong. We can infer that the likely reason it doesn't say the accusation was wrong is that the accusation is right. Instead, it says several other things, which sound like they are refuting the accusation but are actually refuting other things that nobody said.

Exactly, otherwise LG legal would be threatening the authors to publish an apology or be sued.

If they aren't suing they are guilty as hell. Even if they were only most guilty they would sue; their legal dept knows they have no legs to stand on.

> processing is not recording

Debatable and definitely semantic - at the very least this requires putting the audio into a buffer, so a newly mallocd block of memory. Sure, it’s not a recording in a conventional sense, but it is a copy of data.

This is such a programmer view. No lawyer would think that a graphic equaliser records audio.

You'll be delighted to learn that this exact reasoning had, in fact, been used by the copyright industry against (illegal) movie streaming websites. If I remember correctly, this was in Germany and was, after a relatively short time, no longer accepted by the courts.

Read it more carefully.

They are claiming three things:

1) that the speaker (the electromagnet and cone) is not processing any video data, and that it is not performing any analysis of the audio data.

2) All the data the speaker gets is processed by an ``ACR'' processor.

3) The ACR's audio fingerprinting algorithm does not use video data.

It says nothing about whether the ACR fingerprints or sends other data, or if there is a "VCR" or some other chip that separately processes the video. It definitely doesn't say anything about the processing done on the server side, whether they can sell residential proxy access, etc, etc.

At least my TCL TV has a physical switch to disable the microphone (and has never seen the internet, of course). It complains the switch is off at boot every once in a while. There are no complaints about the network unless I accidentally push one of the eight "Google, spy harder!" buttons on the remote.

As usual, the key to explain the discrepancy between LG's claims and the paper 2024 is in the wording. Read carefully: LG claims it "does not collect screenshots, screen recordings, video recordings, voice recordings, or other audio recordings from the TV.". IOW they are making the technical distinction between "fingerprinting" and "screenshots or recordings".

And specifically, they are not confirming or denying that video fingerprinting are done.

What I think is likely is, as the paper states, that they fingerprint both audio and video. Upload both to their servers. But they end up using only the audio fingerprint for ACR. In this situation, neither LG's statement, nor the paper's statement, nor the GamerNexus folks's claims are incompatible with each other.

It even makes sense from a technical standpoint: it is far easier to uniquely identify content by audio than by video, as a fingerprint of a few milliseconds of audio is pretty darn ideal, compared to fingerprinting even a single video frame which has hundreds of ways it could be compressed depending on codecs, bitrate, resolution, etc.

> So they are claiming that ACR is done entirely through audio processing, and no visual data from the screen itself is used? That...doesn't seem plausible.

It apparently is.

Do you know the Nielsen Ratings? That's exactly how they know what people are watching these days. I've been contacted by them to be one of their subjects. They ship you a device that listens and recognizes based on content. They look for certain "fingerprints" in the audio and match against that - it's not capable of recording our conversations, etc (or so they claimed).

This seems like a credulous argument based on no facts you have provided.

If you explained how the box was hooked up, it would be easier to judge whether there was a chance you were correct.

As it is, your description isn’t even clear whether or not the box contains a microphone.

nielsen's ACR method is embedded into millions of devices and vendors. No need for a microphone, it's processing the audio signal being sent out. A microphone would be a wasted conversion..

(your car infotainment also likely has nielsen tech in it most likely, as they bought arbitron and gracenote)

Notably, the TV was caught making audio recordings and transcripts of conversations, and sending them to LG, independently of all this.

Nielsen is global Company that is used for pricing ads on TV stations around the world. Their way of doing it from what I know personally is that they sign up people to put this ACR boxes voluntarily and then based on extrapolation of data - they can tell you pretty close what was the viewership across demographics. Similar to how election polls are done - you just need a good sample.

It's been done for at least good 15 years.

You know you can look it up if you are skeptical, right?

LMGTFY was made for people like you.

The Shazam app on my wife’s iPhone can identify TV shows and movies very quickly, sometimes nearly instantly. Not sure how it does that.

It is pretty neat and several resources online explaining it but it chunks the recoding and does a hash of the fft of each frame i think which reduces the data a lot. The server has a pre hashed database https://hackernoon.com/how-shazam-works-in-a-nutshell

I forgot the part about finding the dominant frequency in each chunk

TV shows are completed and in the can well before air date. It is entirely plausible that the interested party in having the content identifiable by Shazam like services submit whatever needs to be submitted for new content

I have also wondered about the possibility of media emitting some kind of hidden identifier. Can normal speakers emit noise outside of human hearing that could contain a unique id? Would not even need to be a lot of data that could be broadcast.

That's not necessary. If a service has access to the raw audio of a show, it can fingerprint each second of that audio in a way that can be matched in a tiny amount of computation even for a recording in a noisy environment.

That can't recognize what you say. But, it can ID where you are in a specific show out of zillions of hours of shows.

Notably, the caught the TV also recording and transmitting recorded audio and transcripts from the microphone.

Honestly, it doesn’t even need to be outside the range of human hearing.

A quick search for “audio steganography” should answer your question (and be a fun rabbit hole if you find that sort of topic interesting)

Yes, it's possible. Some sports broadcasts do this. The ones I'm familiar with use a high pitched tone on the edge of human hearing but still audible to most people.

Streaming services watermark the video as opposed to the audio as I understand it.

But that's for tracing pirated content back to the originating user account. It's not particularly useful (also entirely unnecessary and overly complicated) if your goal is to ID a piece of content as opposed to an account.

Live broadcasts make it hard for Shazam type apps to ID something from a fingerprint, so they need something else to help.

Signals analysis is pretty refined and not THAT compute intense.

I know a guy who made a Shazam-like phone app that can listen to a few seconds of noisy audio and make a fingerprint that can be used to quickly ID those specific few seconds out of a pre-fingerprinted archive of an enormous amount of audio (zillions of hours of TV). Making the fingerprint requires a tiny amount of very smart code (in C with no dependencies). But, the fingerprint is not useful for understanding audio that's not in the archive.

It's how things were always done. The content from broadcasters has/had audio watermarks...frequencies which humans can't hear.

As far as I know, watermarks never took off because the technical complexity and lack of standardization. Nielsen researched and developed ACR technology but it never required watermarks.

When Nielsen first started collecting data (1950s), they handed out diaries to a group of around 5 000 selected households. Nielsen would then collect these diaries and extrapolate viewing patterns across the entire population.

After that came phone surveys. Next step (1980s) was the "people meter", a small box attached to the TV that could automatically detect which channel was tuned and which household members were in the room.

In the 1990s the set-top box made all of that redundant as the cable and satellite providers could directly see which channel every single box was tuned to at all times.

Broadcasters: the cutting edge of streaming information is ours! Now let's make it so everyone unknowingly broadcasts as much info back to us as possible!

Poor Farnsworth. He just wanted edutainment, man.

I have a friend who got a Nielson device recently and they were told it relies on watermarks. Their website says a combination is used: https://www.nielsen.com/insights/2023/how-to-measure-tv-audi...

A long time ago (~1998) I did some consulting for VEIL and Neilson was definitely talking to them...

https://en.wikipedia.org/wiki/Video_Encoded_Invisible_Light

> watermarks never took off because the technical complexity and lack of standardization

Both audio (sports) and video (netflix et al) watermarks are alive and well. They are used to trace piracy (ie account ID), not for content ID (at least AFAIK).

Regardless of it being how it always was done, such a finger print can easily be injected into LG's advertising ecosystem to infer everything about your demographic and what your interests and income might be and hit you with more specialized ads.

What we watch is not OK to be fed ads, especially if I wasn't using their service to being with and its monitoring the audio from any input to do this.

In this way, smart tvs and smart home devices are effectively hostile devices behind your router at home.

Yes. It’s also horrible that they have microphones in your home listening to your conversations. LG knowing what I’m watching is awful, but it seems even worse for LG to listen in to the conversation I have with my loved ones about it after. I don’t want to be under surveillance in my own home.

Both are unacceptably egregious and done for zero benefit of the customer and a disproportionate and asymmetric benefit for the manufacturer.

I've been trying to learn how to secure LG TVs, and saw that some people do seem to jailbreak them withan open version of webOS.

> I've been trying to learn how to secure LG TVs

It’d be wonderful if we had a grapheneos equivalent for tvs. They’re very capable Android devices. Such a pity “we don’t own the glass”.

The good news is there is no good reason to plug the TV into the internet.

To watch movies from a streaming service?

Use Apple TV for that.

I.e. spend more money to do things the TV can perfectly well do. We should make the spying illegal so we can use the devices we buy to their full potential without being sold to advertisers. "Give money to this other company that may or may not also be collecting data and may also sell you out in the future" is a suboptimal solution.

I don't think we can do anything substantial. So I'm going to just use this "suboptimal" solution.

No, we should decouple the display hardware from the playback device. Spying or not, the playback part will be obsolete long before the display part.

If you want true, verifiable privacy and control, it's not an Apple TV that you need. Any old laptop or desktop computer can be used to stream content from the Internet using a Web browser or other "apps."

E.g. Netflix doesn't let you to stream 4k video in browser afaik. So no, it's not a good option.

Desktop OS also don't support Dolby Vision or fancy spatial audio formats.

Trifecta: Piracy + Local media server + Streaming device, either Apple TV/Android TV (without internet access).

No loss of quality, devices that could spy on you, don't, and those that would spy on you, can't. The only trade-off is some convenience.

It does let you do that, but only on platforms where they can enforce HDCP. So e.g. Edge on Windows or Safari on macOS work fine, and I think Chrome recently joined the list too. But not on Linux.

Always, and only use an external device for streaming services, never the software built into the TV.

Apple TV, Android TV or other devices are perfectly capable and better integrate with mobile and other devices in your network.

The tradeoff consumers are sold is trading convenience of in device apps for security.

Smart home devices like TVs, and thermostats should be treated as default hostile and isolated on a guest wireless network instead of your main one.

Also, they didn't claim that.

Is that how they do it lately?

I participated once or twice a good number of years ago, and it was kind of a pain: It involved keeping a paper ledger of what was watched, and when. Correspondence was all handled by regular mail.

(As I recall, they included a small amount of cash ~every time they sent more correspondence and this was a primary motivator to keep going with it.)

> That...doesn't seem plausible.

In what way? Dramatically lower processing and signature complexity. Audio signature matching is trivial and extremely well known. I see absolutely nothing implausible about this, and it seems a robust, viable solution.

> This paper from 2024 investigated both Samsung and LG and found that they both capture screen images for ACR, and send the resulting hash (not the raw content) back to the manufacturer for identification.

That paper found no such thing. That paper actually demonstrated that they have no clue how the ACR happened, they just demonstrated that playing content yielded content IDs. It is more likely they were witnessing audio ACR happening, exactly as LG described.

I can’t speak to how LG does this now but I ran an agency that built Smart TV apps and built one of the first ACR powered apps on LG about 10 years ago. We were working with a company called “Cognitive Networks” which later was bought by Vizio and is now their Inscape product. At that time one use case wasn’t just tracking but actual interactive “sync to broadcast” apps (you can still do this, no one does, and I don’t know why)

At that time during testing Cognitive could literally see what we were playing on our TV (not full video but the frames used for fingerprinting)

They don’t use Cognitive anymore for obvious reasons and there are several audio based ACR solutions but they always had issues with sections of video without much audio to work off of so we’re always considered inferior. They are fine for usage data however.

Anyway my $0.02

Does it matter? Whether they are doing it on device or in the cloud, they are still recording what their customers say and collecting data on it without their consent.

To me, this is really an admission.

No, I think they’re saying two separate things:

- ACR uses audio fingerprinting

- ACR does not collect screen recordings

Both can be true if the TV hashes the frames locally and ACR “collects” the hashes.

Or if they took all this time to respond because they were busy putting all the stuff they are denying in a second program they called "bcr"

They're almost certainly being pedantic about what it means to "collect a recording".

Tom's response: "Sounds good, please don't take offense at me adding https://github.com/furkan-bayrak/lg-tv-blocklist to the PiHole. Can never be too safe, right?"

FWIW, LG will connect to a public DNS and use encryption so a basic PiHole list doesn't help unless you combine it with firewall rules. See the caveats section of that Github link.

Yeah, I went with just the Safe settings for now as I am leaving for the week and didn’t want the rest of the house to have to fix something.

This developer did actually find screenshots on their TV of everything displayed on their screen, even when they set every available option that's supposed to stop ACR:

https://www.reddit.com/r/LGOLED/s/x8iBNCPya5

Get saavy...? More like "will require trust that manufacturers are honest" -- which I won't believe for a miliesecond.

Yeah, I don't know what I was thinking when I wrote that. No one reads the ToS anyway. Just stop buying TVs, now that Sceptre stopped delivering the last models of consumer dumb TVs.

The key problem is content identification, not how it is done. Seems like they are doing "look over there!" thing.

on-device transcript of audio recording is not audio recording ;)

From reading other responses, it seems there is an assumption the image itself is fingerprinted. The digital content is encoded, there is essentially a barcode on your TV screen with lines running horizontally that you cannot see with the human eye. The encoding is picked up as the signal, it does not need to see or recognize if that is your favorite actress on the screen.

Real question here: As I understand, voice (sound) recognition technology mostly uses hidden Markov models, instead of LLM/AI. Do I misunderstand? I think this is how Dragon NaturallySpeaking and Shazam works.

To be clear: I do not agree with any of Samsung's and LG's efforts to record sounds/words from user homes!

this is clearly an "anonymization" claim.

What is anonymous: we record all the hashs from all the programs people are watching to identify people watching the same thing.

What is not anonymous: we hash all the content in the world, along with hashing the content people are watching, and reconstruct what they watched.

> ACR uses audio fingerprinting technology

so they aren't even denying listening in on everything?

"Everything" would include the microphone, both in the remote and the TV. They're claiming to split off the audio, with one path going to the speakers (and there to your ears), and the other path being hashed (and from there to LG).

They still claim to get your media's audio, but deny using the microphones.

If they don’t use the microphones why do they have a statement in their Terms of Service to not say sensitive things in front of your TV? It says the TV owner is "solely responsible" for obtaining all necessary consents from third parties whose voices may be recorded by the device, and must warn household members and guests that their voices may be recorded, and if someone does not agree, the TV's microphone and voice functions need to be turned off. [0]

[0] https://www.lg.com/us/terms

>If they don’t use the microphones why do they have a statement in their Terms of Service to not say sensitive things in front of your TV?

Other people have mentioned there's other voice features like diction/voice control, so it's plausibly for that.

That's probably the program that uploads everything you say then. Nobody thought the ACR was doing that.

> If they don’t use the microphones why do they have a statement in their Terms of Service to not say sensitive things in front of your TV?

1. The introduction says that Smart TVs are not included in this ToS ("not including Smart TVs").

2. Where do the terms say anything about "sensitive" content? The closest thing I see is section 4.d, but that's just about wiretapping/privacy laws in general.

Which paragraph?

They deny ACR uses the microphones. Big difference. Nobody thought ACR used the microphones.

They explicitly state that the audio ACR is done through the "TV’s internal audio processor". e.g. rendered audio, not recorded audio. I mean, you could stretch the claim to have it internal include recorded audio, but that seems dubious.

Why are you giving a shady company with shady terms and shady history the benefit of the doubt?

Because when people cry wolf, and then there is no wolf, it actually harms the consumer by lowering everyone's guard. Have people not learned this yet?

Gamers Nexus discovered recently, through their "AMD blacklisting" bit (when some relatively minor mid-lifecycle refresh of a product they didn't get a demo unit, so it turned into some "we are the truthsayers!" bit), that doing the Louis Rossmann routine earns them loads of links and clicks. So they're firmly in the cry wolf territory now, and it makes me more dubious of their claims that the people they are questioning.

This whole space is filled with bullshit now. Saw another video where a big channel talks about why TVs are so cheap now, and they then explain it that it's because they sell your data. In the real world, the selling data bit, ACR, and so on, is absolutely tiny dollars business. TVs are cheap because massive factories are pumping out these almost entirely plastic products in enormous numbers, and they're extremely cheap to make, and the IP has all been long amortized out.

Still doesn’t mean they’re not selling the data?

I agree with you that accusations need to be backed by proofs and the kneejerk reactions on HN are embarrassing to read and unhelpful. Big bad evil corp, every single time. I mean those reactions are all over social media, but I just expected a little bit less knee jerk from HN.

> In the real world, the selling data bit, ACR, and so on, is absolutely tiny dollars business. TVs are cheap because massive factories are pumping out these almost entirely plastic products in enormous numbers, and they're extremely cheap to make, and the IP has all been long amortized out.

Unfortunately that part if your comment is provably false in at least one instance: Vizio. It's a shame, I thought we were on the same page about spreading half truths.

Vizio's numbers are famously public due to its recent sale. We know they lost money on most televisions sold (not all!), and they made it up in ad revenue and content distribution from those TVs. It doesn't prove that LG loses money on its TVs, but it's clearly not as clear cut as you make it out to be.

> Vizio's numbers are famously public due to its recent sale.

Vizio's numbers were public because they went public in 2021 and like every public corporation they have to report numbers. The sale to Walmart actually made their numbers private again because while they're a part of public company still, it's now thoroughly washed in such a mass of numbers it disappears in any quantifiable way.

> It doesn't prove that LG loses money on its TVs, but it's clearly not as clear cut as you make it out to be

How clear cut do you think I made it? You seem to be claiming my comment said something it didn't.

TVs are being subsidized by secondary businesses for some vendors, to some degree, but that isn't why TVs are cheap. If you completely removed that factor, some makers would be slightly more expensive...but not by that much at all.

Like people do a lot of clever positioning to grossly overstate how much they make from this. And it's worth noting that much if not most of the revenue people ascribe to "ads" or privacy invasion on Vizio, actually came from their Connected+ platform. Vizio had a platform, just like Apple does, and just like Apple they took a cut of every subscription signed up for, or piece of media purchased.

I remember back in the day when laptops had a bunch of pre-installed junk and stupid stickers all over them -- at least in the Windows world -- and people would claim this "subsidized" the laptop. That it made it much less expensive. Some people ran the numbers and it was utterly marginal, but they did it because the average person simply didn't care. If they just increased the price the tiny amount and removed that shit the product would be better, but if most people don't care and you can eek out a tiny bit more, they do it.

I agree with you re Gamers Nexus, but honestly I'd rather have Gamers Nexus than not anyways.

> Saw another video where a big channel talks about why TVs are so cheap now, and they then explain it that it's because they sell your data. In the real world, the selling data bit, ACR, and so on

> is absolutely tiny dollars business. TVs are cheap because massive factories are pumping out these almost entirely plastic products in enormous numbers,

Right, and Windows Recall is not technically spying on what you're doing etc. etc.

It seems to me like you're being pedantic but essentially end up seeming like shady corporate practices are fine with you over somewhat inaccurate claims that nonetheless point to a real problem?

Yes, TVs aren't cheap because of (only/primarily) ACR but the points stands that ACR shouldn't be a thing on a TV I fully paid for and nobody but me, who paid for the TV, should 'own the glass'.

They're not denying anything about programs other than ACR. That's telling. They didn't say "your TV doesn't listen" or "your TV doesn't collect"

The thing which depresses me the most is all these so-called smart TV's are giant Arm computers that run malicious software. Imagine if we could re-flash your TV with Linux or whatever.

I can imagine that. We'd have a slow SBC with a fast video decoder, a huge screen that is inseparable and also now uncalibrated, some video inputs for other things, maybe a tuner if anyone can figure it out, and some kind of network connectivity.

I could probably come up with a use for that, but it's about as likely as coming up with a plan for one of the Raspberry Pi Zero Ws that are sitting in the drawer.

How they spy on people isn't the issue.

Spying on people without explicit consent (in a situation where you can say no without penalty) is the issue.

After doing some investigation into my Bang Olufsen after some tech not working right apparently Dev mode on it allows "Most probable raw grab: ThinQ/SSAP on the LAN after pairing — ~960×540 JPEG. Live Plus/ACR: most probably sends a fingerprint, not a retrievable raw frame."

As per HN thread last week

especially when emebeddings are enough to recover original signal if the model is built for it, which these no doubt are.

Has that paper been replicated?

Well, not that Apple is doing it all their fans will claim it's ok

> We're going to have to get saavy in pulling apart the distinction between

We probably shouldn't: doing any of this horseshit is a good reason to return a product. We should start doing that en mass until they get the idea.

Reply on news.ycombinator.com