Not in front of the telly: Warning over 'listening' TV
bbc.co.uk
bbc.co.uk
I think it's really poor reporting (but not unsurprising) that the BBC hasn't mentioned other devices that have similar issues.
Same situation with 'Ok, Google'.
Initially, the 'Ok, Google' phrase was limited to certain phones that had the audio processing chip in them. I don't know if this is still the case.
I doubt that was ever actually true. It was probably a kind of shorthand to explain to users that some processors had the right kind of power management to enable efficient always-on speech recognition.
And, another thing, local speech processing doesn't mean you are safe from recording or from large-vocabulary transcription. Compared to what 1980s speech processing runs on, even when throttled-down to conserve batteries, you've got ample processing power in modern smartphones.
I've turned it off for everything aside from my Xbox One which I find myself trusting for some reason.
Apparently it's an option in the US (but not the default?).
Considering it wasn't even available in Germany for quite a while, I wouldn't be surprised if there are legal requirements surrounding this feature.
http://youtu.be/arsAs9pGrBk?t=52s
I don't know for sure that the tigger word is processed locally on SmartTVs too, but it's likely because Samsung said: 'voice data is provided to a third party during a requested voice command search', so you have to request it's happening probably with the trigger word. And technically it would not make too much sense to constantly stream audio from every SmartTV because the trigger word recognition is a simple enough task to do it locally and also the continuous stream would consume lot of bandwidth for the users and probably for the servers too.
But it's still very concerning that we have more and more devices with microphones and internet connections and in the case of SmartTVs proprietary OS with questionable security.
The funny thing is that ever since Xbox one I have gotten so used to voice commands for playing/pausing/muting videos that I ended up building one on raspberry pi to control the tv, lights and other devices.
Any suggestions?
It is possible that someone will make an MIT licensed version (and could do so legally in some countries that aren't the US), but it would be technically illegal to distribute in the US.
You can always buy NUAN stock. I'm serious, this isn't hyperbole or sarcasm. I won't buy a "merchant of death" like Philip Morris, but I'm going to check out Nuance. If they really have become a monopoly, perhaps there's some money to be made by investing in them.
Yes I know it sucks, and in an ideal world you have every right to be "pissed off". But in the real world, you'll do better to remember the slogan: "if you can't beat 'em, join 'em".
I personally am much "more pissed off" at how companies like Comcast, who are "natural monopolies", have been extracting ever larger "monopoly rent" from everyone. They should be much more tightly regulated than they are.
Its not very accurate, but if you limit it to a small set of keywords, you are going to be fine.
I'm not saying there's nothing wrong with the trend of personal and home devices becoming surveillance machines, there's a lot wrong, but Samsung in this case is an example of how you do it properly if you have to do it (it's a feature that apparently has to work the way it works).
For the Smart TV, How do you hardware disable the smart TV microphone? I'm searching online but don't see directions yet. Can you do it without opening the TV outer case?
Here's an article on how to block it using your router but I don't think this would defeat malware. http://www.tomshardware.com/news/lg-smart-tv-hdtv-doctorbeet...
Interested to hear ideas & opinions from HN.
If something in my house was continuously transmitting a stream of audio, I'd notice. Very, very eventually, but I would notice. There's enough of us out there that this sort of thing is harder to sneak by than you might first guess. Home networks are easy to sniff because they're so empty, whereas my work network is a constant stream of mDNS, DHCP, and all sorts of other broadcast traffic to step through before I can see anything interesting.
(Also, yes, I'm eliding details like wired vs. wireless sniffing, etc. And I'm not talking about the router, though evidence online suggests there's a set of people periodically sniffing the router<->internet, too. And yes, clever clogs could try to time things to when people may not be looking, etc. The point is that the traffic is not as unwatched as you may think, not that the watchers are perfect.)
Apart from OpenDNS I'm guessing companies like ESET (Antivirus) will monitor network activity and look for streaming audio and trigger something? Or maybe that's a more tailored alert.
We are probably the fastest growing (revenue) security company in the market today, and our good reputation is a big part of it. I say fastest growing for at least companies north of $10m ARR. It's easy to be doing 1000% growth < $10m ARR. :-)
-David
However, for the smart TV, broadly speaking, they can disguise what the traffic is, but they are not capable of disguising that there is traffic, and without engaging in outright deception can't disguise where the traffic is going. (I mean that caveat about outright deception... it is theoretically feasible, of course.) (If the TV is wired-only, I'd have to insert my computer between the TV and the router. This is a few minutes with Linux routing commands. If it's wireless I just sniff the wireless.)
And many of the cases we are talking about are cases where the mere presence of traffic, or traffic in a certain shape ("a continuous 4kilobit stream" -> audio stream), is intrinsically suspicious. Netflix pouring megabytes into my console when I ask for a movie is not surprising; constant leaks coming out of my cell phone when I'm not actively using it would be, whereas occasional bursts to Google Play servers or my corporate email server wouldn't be. The topic of "metadata" is one that comes up a lot in these discussions, and here's an example of where that can play in our advantage for once... you can tell a lot just by looking at a stream's basic characteristics, no matter how encrypted the internals may be.
You use software that you trust.
Yes, that restricts options severely... I mostly use software whose source is public and anything closed is handled as suspicious (for example, Cyanogenmod's Privacy Guard comes handy to fence applications in - but something as basic as looking at networks traffic is a good basic check).
You'd think the fact that a smartphone stays in your pocket would be more alarming. The things have multiple cameras, microphones, GPS tracking devices, and a whole myriad of personal information stored on them.
They're even rectangular screens!
Someone needs to write an article that refers to smartphones in the context of "telescreens" and describe what they do matter-of-factly so we can snap out of it...
Unless you tunnel all your data traffic they'll also get copies of that and may sell pseudo-anonymous website usage statistics to one of the web metrics businesses. In some countries they also intercept and modify web content that you might view.
And what can you do about the baseband radio processor and its code? Nothing. Assuming you have a tunnel in operation, the phone could still be collecting and quietly sharing metadata and you'd never know.
The baseband has its own processor and, to my understanding, pretty much complete hardware control of the phone.
I don't deny that that the benefit is non-zero, but I think saying "it's not a silver bullet" is still overselling it. I think it would be more accurate to describe it as "It's all I can do, and it's better than nothing."
Imagine every American being in the vicinity of a remote-controllable intercept device with a microphone, camera and GPS tracker 24 hours each day.
But don't worry, you have nothing to hide, right? Can't let the terrorists win.
No taking it very seriously would mean refusing to implement this feature unless you can do it without sending audio recorded in the room over the Net.
I don't think it would be hard at all for NSA/GHCQ to tap into a feed like this, Samsung/3rd party willing or not.
I just checked and "hey Siri" is recognised offline.