News for hackers. Stuff that matters.
Re:Amazon device recorded private conversation, sent it out ... by tambourine_man on Thursday May 24, 2018 @12:45PM (#17145810)
That pocket computer can be programed to listen, or not.

The whole point of these cylinders is to be listening at all times.

Re:Amazon device recorded private conversation, sent it out ... by mikeash on Thursday May 24, 2018 @12:52PM (#17145903)
Lots of phones can be set to listen all the time, and you have no way of knowing if it’s been programmed to listen even if you turn that off.
Re:Amazon device recorded private conversation, sent it out ... by tambourine_man on Thursday May 24, 2018 @01:06PM (#17146060)
Lots of phone can be set to not listen all the time. iPhone for instance.

Yes, it’s ultimately trust in the device maker, the compiler, the chip manufacturer, etc, and those can and have been verified to some extent.

But that’s not the point. A phone can listen or not, where you have no doubt with the cylinder. It’s its raison d'etre.

Re:Amazon device recorded private conversation, sent it out ... by mikeash on Thursday May 24, 2018 @01:09PM (#17146078)
OK, but you used the word “tapped.” A smart speaker isn’t supposed to be tapping you any more than a phone is. In both cases, they have to be doing something more than they’re supposed to.
Re:Amazon device recorded private conversation, sent it out ... by tambourine_man on Thursday May 24, 2018 @01:28PM (#17146263)
I disagree. To be listening at all times is the very definition of a tap, don’t you think?

And people know this. It’s not like they are being misled. It’s a conscious exchange of privacy for convinence. It’s just that, in my mind, you are getting very little for what you’re giving.

Re:Amazon device recorded private conversation, sent it out ... by mikeash on Thursday May 24, 2018 @02:29PM (#17146871)
In my mind, you’re giving almost nothing if you already have a cell phone.

I made a different choice, but I totally understand why someone would choose not to have a phone or smart speaker due to privacy concerns. What I don’t get is someone who has a phone but sees smart speakers as crazy.

Re:Amazon device recorded private conversation, sent it out ... by tambourine_man on Thursday May 24, 2018 @02:48PM (#17147055)
So, if I understand you correctly:

- You are pretty certain that your phone is listening at all times, even though it's set not to.

- You see no difference between a product that's advertised manly as a listening device and one that also has such a feature, that can theoretically be turned off, and is very useful otherwise.

Re:Amazon device recorded private conversation, sent it out ... by mikeash on Thursday May 24, 2018 @03:05PM (#17147216)
I don’t think my phone is listening, other than the wake word. Same deal with my smart speakers. I think either one could, if hacked or just updated by the manufacturer with nefarious intent.

I see no difference, privacy-wise, between the two. I don’t care how they’re advertised, I care what they’re capable of.

Re:Amazon device recorded private conversation, sent it out ... by tambourine_man on Thursday May 24, 2018 @03:44PM (#17147595)
That wake word can be disabled in your phone and it's perfectly functional without it. This way, it only listens when you want it to (theoretically).

I'm sure you can appreciate the difference: press a button to talk to Siri vs Siri is always listening.

The latter seems crazy to me, on a phone, cylinder, laptop or whatever device it's implemented.

Re:Amazon device recorded private conversation, sent it out ... by mikeash on Thursday May 24, 2018 @05:01PM (#17148373)
What’s so bad about having a small processor run a recognition routine on all incoming audio, discarding everything that doesn’t match, and activating the device if it does? Are you just worried about accidental activation?
Re:Amazon device recorded private conversation, sent it out ... by tambourine_man on Thursday May 24, 2018 @05:56PM (#17148824)
>What’s so bad about having a small processor run a recognition routine on all incoming audio, discarding everything that doesn’t match, and activating the device if it does?

If that was the case, nothing. But we have enough evidence to believe it's not. While having the device listen, even though it's been explicitly configured not to, is a bit more of a stretch.

>Are you just worried about accidental activation?

That could be an inconvenience too, but I'm more concerned with malicious intent.

Re:Amazon device recorded private conversation, sent it out ... by mikeash on Thursday May 24, 2018 @06:37PM (#17149113)
What evidence do we have? I’m about 99.9% sure that this story is just accidental activation and bad reporting.

If you’re concerned with malicious intent then I really don’t understand the difference. If the device maker is trustworthy then you’re fine either way. If they’re malicious then you’re screwed either way. A setting for “please don’t listen” isn’t going to make the slightest bit of difference if they’re malicious. M

Re:Amazon device recorded private conversation, sent it out ... by DmenshunlAnlsis on Thursday May 24, 2018 @06:39PM (#17149131)
Trust is proportional to access. I don’t trust any third party with an always-on microphone in my house, especially one that’s networked. Malice aside, I don’t trust their competence.

Nor should anyone I think.

Re:Amazon device recorded private conversation, sent it out ... by mikeash on Thursday May 24, 2018 @06:57PM (#17149251)
That’s fair, but again, a smartphone fits that description too and nobody is talking about how you’d have to be crazy to let one in your house.

It seems to me that smartphones are significantly worse. You can unplug your smart speaker or kick it off your WiFi and be confident that it can no longer hear you. Smartphones have batteries and cellular data connections. Also they’re usually with you at all times, even when you’re away from home.

Re:Amazon device recorded private conversation, sent it out ... by DmenshunlAnlsis on Thursday May 24, 2018 @07:32PM (#17149429)
That’s fair, but again, a smartphone fits that description too and nobody is talking about how you’d have to be crazy to let one in your house.

A lot of people talk about it, they’re just laughed or shouted down. There’s also the argument that mobile phones undoubtedly offer a number of incredibly useful tools, not the least of which is a primary phone line. I think anyone would be hard pressed to argue for commensurate utility from Alexa or similar products.

Re:Amazon device recorded private conversation, sent it out ... by tambourine_man on Thursday May 24, 2018 @07:59PM (#17149563)
It's a worse PR nightmare if discovered, so a bigger risk.

“Networked device with microphone records and uploads your voice” might create reactions such as: yeah, what did you expect, how else would it work?

“Networked device with microphone records and uploads your voice even when explicitly told not to” is a lot worse. Company X is lying to us!

Re:Amazon device recorded private conversation, sent it out ... by jethro_tell on Thursday May 24, 2018 @12:57PM (#17145957)
Can you? I'm not a tinfoil hat, but the echo is only listening when you address it. It also has a physical mic kill switch, but you don't really know that either mic is not live at any time.

My guess is they mostly do work that way but bugs and vulnerabilities don't seem like a stretch. (As is to be expected with all software)