I wonder about this one. Everyone's device has the same "password" (i.e. "wake word"), the device is attached to your home network and associated with your credit card, and programmatic ads apparently receive little to no vetting. Even if there are no bugs in the code that sends the audio to Google/Amazon and deals with the results, I'm reminded of an article here awhile back about researchers creating special eyeglass frames to make one face look like a completely different one to modern zillion-parameter facial recognition algorithms. This will not end well.
It seems like figuring out how to exploit these types of devices to be "always-on listening devices" is exactly the type of thing NSA, et al., would be interested in doing.
Do you not own a smartphone that could conceivably be compromised in the same way?
Is there anyway for end user to know what "wake up" keywords are? How do I know it's not listening for keywords like "buy" (example: "You should `buy` milk") and then targeting adds that way?
What happens next time FBI decides it wants google (et. all) to leave its device "always awake" on some person of interest ?
Can a third party somehow compromise the security to change the list of "wake up" word?
Maybe you can add voice recognition along with keyword to make sure it's only responding to authorized people. But even then, seeing how far machine learning has come, is it really a security?
On a side note, do these devices only capture human audible range of signals? Or is there ways to send non-human audible signals with commands and wake word and what not? Dog whistle for alexia or Home .. Alexia whistle?
Edit: typos and clarity