News for hackers. Stuff that matters.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by accnumnplus1 on Thursday December 20, 2018 @01:48PM (#18727766)
This is just facebook all over again. Why can't people see trouble-tech? I never used facebook and won't ever use an alexa, nor whatever google's thing is.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by Zelphyr on Thursday December 20, 2018 @01:56PM (#18727855)
I don’t know why this is getting downvoted. I feel the same way. Amazon and Google have yet to demonstrate to me that they value my privacy enough to take necessary steps to protect it. They, like Facebook, know most people foolishly don’t care enough to hold these companies feet to the fire on it.

At the risk of stating the obvious; Facebook has more than demonstrated the opposite.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by lykr0n on Thursday December 20, 2018 @02:08PM (#18727991)
The only company I've seen take demonstrable action to protect their customer's privacy is Apple.

Google, Facebook, Microsoft, Amazon have never given me a single reason to trust that they have my privacy concerns on their mind.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by bduerst on Thursday December 20, 2018 @04:04PM (#18729108)
>The only company I've seen take demonstrable action to protect their customer's privacy is Apple.

The same Apple that gave the Chinese government access to all their Chinese user's iCloud data?

https://techcrunch.com/2018/07/17/apples-icloud-user-data-in...

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by patrec on Friday December 21, 2018 @03:45PM (#18736488)
Is there anything Apple could have done to protect the privacy of its Chinese users better (whilst still having some)? You could say they shouldn't have Chinese users, but that's a different argument, I believe.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by mlindner on Thursday December 20, 2018 @04:23PM (#18729252)
This is false. iCloud data doesn't contain phone call contents or iMessage data contents. Yes they gave access to metadata, but this is China where privacy basically doesn't exist, not a western country.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by bduerst on Thursday December 20, 2018 @04:36PM (#18729364)
Wrong - Apple moved all iCloud data, which includes text messages, email and other data stored in iCloud (according to Reuters) as well as the access keys. Apple even forced users to sign the updated TOS or drop service.

The Chinese government access is _not_ limited to metadata.

https://www.reuters.com/article/us-china-apple-icloud-insigh...

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by mlindner on Saturday December 29, 2018 @01:57AM (#18782370)
Text messages are not stored in iCloud...

https://support.apple.com/en-us/HT202303

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by B0btheBuilder on Thursday December 20, 2018 @05:21PM (#18729708)
>iCloud data doesn't contain phone call contents or iMessage data contents.

Literally the first paragraph of both of bduerst's links suggest otherwise.

Also, I don't know if you've used iCloud on multiple devices before, but it very much contains iMessage data contents.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by tfha on Thursday December 20, 2018 @02:33PM (#18728270)
But with Apple's entire ecosystem being closed and intentionally locking you in, is Apple really a better choice. All it takes is one decision from the board that it would be more profitable to start violating privacy.

The board's legal mandate is to make as much money as possible. As soon as privacy is no longer a fad that makes more money and growth than the opportunity cost to not violating it, Apple will flip a switch. That's their duty as a for profit company.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by ceejayoz on Thursday December 20, 2018 @02:39PM (#18728345)
> The board's legal mandate is to make as much money as possible.

Why do people keep repeating this falsehood?

https://www.nytimes.com/roomfordebate/2015/04/16/what-are-co...

Per SCOTUS in US v. Hobby Lobby:

> While it is certainly true that a central objective of for-profit corporations is to make money, modern corporate law does not require for-profit corporations to pursue profit at the expense of everything else, and many do not do so. For-profit corporations, with ownership approval, support a wide variety of charitable causes, and it is not at all uncommon for such corporations to further humanitarian and other altruistic objectives. Many examples come readily to mind. So long as its owners agree, a for-profit corporation may take costly pollution-control and energy-conservation measures that go beyond what the law requires. A for-profit corporation that operates facilities in other countries may exceed the requirements of local law regarding working conditions and benefits. If for-profit corporations may pursue such worthy objectives, there is no apparent reason why they may not further religious objectives as well.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by tfha on Thursday December 20, 2018 @04:52PM (#18729489)
The key there being 'so long as it's owners agree'
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by ceejayoz on Thursday December 20, 2018 @05:21PM (#18729713)
That's a different issue entirely.

Can Apple opt to do bad or short-sighted things? Yes.

Are they legally required to do them to maximize profits? No.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by danso on Thursday December 20, 2018 @02:51PM (#18728478)
What evidence or steps would be sufficient for you?
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by aero142 on Thursday December 20, 2018 @03:07PM (#18728625)
Not parent, but I'll answer.

1) The implementation of the wake word recognition is implemented in hardware that cannot be updated remotely.

2) The device is unable to transmit information without lighting up a TX light. Implemented in unmodifiable hardware.

3) Voice recordings are processed and then deleted within one month.

4) The device is run by a company that doesn't make money through marketing or data analysis.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by Faark on Monday December 24, 2018 @10:50AM (#18752634)
Love your list & know I'm late, but I'd add one item to your list: Make your update mechanism resistant against sending "personalized" update versions to specific clients. A client querying a central server can be overcome with a single NSL, while a peer to peer solution would need to hijack your connection as well.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by Karunamon on Thursday December 20, 2018 @04:06PM (#18729120)
1 means it's impossible to offer better voice recognition accuracy or change the wake word, meaning they get pilloried by reviewers for offering a device that's strictly worse than the current gen, and they get pilloried by HN for contributing to tech waste.

1&2 get the company pilloried by HN the moment a vulnerability comes out.

3 is a requirement that doesn't actually solve any problems and ruins a legitimate need of ML - comparing performance against a known baseline.

4 is overbroad - most software companies make their money through data analysis of one form or another.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by illumin8 on Thursday December 20, 2018 @08:07PM (#18730706)
Be honest, even if the manufacturer tells you #1 is true you're not going to believe them.

You're setting up an impossible set of demands that no manufacturer is going to meet and no consumer really cares about (other than perhaps yourself and a few tinfoil hat wearing crypto-anarchists).

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by aero142 on Monday December 24, 2018 @11:05AM (#18752703)
The iPhone hardware meets my standards. The secure enclave for touchID is detailed in it's description and security. The Apple business model is not data collection, and the legal fights they have put up give me a reasonable belief that they take my security and privacy seriously enough for me. They are also printing money so it seems to be workable as part of a business model. I think you are wrong on all accounts.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by illumin8 on Wednesday December 26, 2018 @05:39PM (#18765518)
I think you misread my comment. I'm actually a huge fan of the secure enclave and the way that Apple protects customer privacy. What I was commenting on was the distrust a lot of people have, combined with a lack of knowledge about how the hardware works. For example, Amazon's echo devices have a physical circuit that disconnects the microphone when you mute it. They could have done it in software, but wanted to break the physical circuit so that there was no question in customers minds whether the device was still listening or not when it was muted.

I trust Amazon as much as I do Apple to protect customer privacy.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by codyb on Friday December 21, 2018 @12:44AM (#18731634)
Can't you set up Alexa on a raspberry pi? I guess you could then have your own trigger word "hello pi" or whatever that you've programmed it to listen for, and only then activate Alexa maybe?

Pain in the ass but you could open source it for the rest of the world.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by aero142 on Friday December 21, 2018 @01:04AM (#18731686)
Yeah, I think you are correct here. I think I would also be happy if someone else was selling me the hardware and I controlled it more, and it just was a hardware pipe to the voice service provider.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by krageon on Friday December 21, 2018 @05:53AM (#18732588)
Hotword recognition does already exist and works on fairly modest hardware (I've never tested it on a pi, so I don't know specifically how well that would work - or more accurately how fast). The trouble is that it's an enormous hassle to set up and while it is open source, it involves some company or other having it's grubby paws all over the recognition networks. Which may or may not rub you the wrong way.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by jacquesm on Thursday December 20, 2018 @08:13PM (#18730727)
> Why can't people see trouble-tech?

I like that term. Would really like a definition.

How does 'technology whose short term value is negated by long term negative effects' sound?

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by cheeze on Thursday December 20, 2018 @02:35PM (#18728300)
I disagree. Amazon seems to actually care about privacy and takes things like this pretty seriously. One could certainly criticize AMZN data collection, but I think Amazon has shown that it does care about privacy of this data. Mistakes do happen which is unfortunate, and I think there is a good argument for no company, no matter their intentions to record this much data.

On the other hand, this is Facebook's business model.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by pixxel on Thursday December 20, 2018 @03:07PM (#18728629)
“Amazon seems to actually care about privacy “

Not according to the NY Times this week. Amazon have been reading your private messages on Facebook.

https://www.nytimes.com/2018/12/18/technology/facebook-priva...

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by tryagainacct on Thursday December 20, 2018 @03:27PM (#18728795)
You might want to read the article again. No part of it says that Amazon read private messages on Facebook.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by bduerst on Thursday December 20, 2018 @04:03PM (#18729098)
Yeah, AFAIK it was login-with-facebook partners like Spotify. Were people ever able to login to Amazon with facebook?
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by CobrastanJorji on Thursday December 20, 2018 @03:25PM (#18728777)
y'know, I never thought about it, but I think I agree with you that being willing to pay another company for access to private information about you probably counts as not caring about your privacy.

It's not as bad. It's the difference between paying somebody to tell them secrets about you and selling secrets about you. But it's definitely not a thing a person respectful of your privacy would do.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by lorenzobr on Friday December 21, 2018 @05:55AM (#18732595)
I find it's funny how people these days think the problem is with Facebook.

Literally every company that has access to users' data has in one way or another some kind of business model based on selling that data. Every day I come across 2 or 3 articles from big newspapers giving Facebook some shit about selling user data. But what about Experian? What about phone carriers? They all sell users' data, maybe anonymous maybe not but they are still making profit on people's privacy.

And when some shit goes down, we make a big fuss about it for a few days and then we go back to normal. Equifax anyone?

Honestly, companies in the position of making profit on users' data have been doing it for the better part of 15 years now, I don't understand why we are acting so surprised now.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by Kiro on Thursday December 20, 2018 @04:55PM (#18729504)
It's the best thing I've ever bought. Whatever bad thing can happen is still worth it. It's a trade-off I'm actively choosing.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by summadat on Thursday December 20, 2018 @05:50PM (#18729932)
What if a trade-off was that your Echo was actively recording and indexing every single word you've said within its range?
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by Karunamon on Friday December 21, 2018 @08:37AM (#18733182)
And while we’re talking about ridiculous what-ifs with no basis in reality, 5G could be giving you cancer!
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by matte_black on Thursday December 20, 2018 @02:56PM (#18728531)
The thing is that for most people avoiding this kind of tech and platforms is unlikely to have any kind of payoff for them. Life is too short.

Most peoples lives are as simple as going to school and work, raising a family, taking vacations, paying bills, and then passing away.

There will never be a moment where they can say “Yes! My avoidance of Facebook and Alexa for all my life has finally paid off! Hahaha!”

The only people who can say that are people who have good reasons to hide: drug dealers with multiple lines of business, professional black hat hackers, home grown terrorists, life insurance fraudsters, etc.

The average person has nothing of interest to offer except more information about them in order to better perceive trends and distribute ads to them so that maybe they buy something.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by bzbarsky on Thursday December 20, 2018 @03:45PM (#18728955)
Your list is missing "pro-democracy advocates", "Muslims", "Christians", "Jews", "atheists", "women who want an abortion", "people trying to escape an abusive relationship", "people with interesting medical conditions", etc, depending on location.

Please don't pretend that both "only criminals have something to hide" and "criminals are by definition bad people" are true statements. Neither is true.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by cortesoft on Thursday December 20, 2018 @06:17PM (#18730138)
I get what you are saying, and agree with you in principle... but the problem is, I am none of those things. I have none of the qualities that I need to hide from anyone, rather neighbors or the government. While it kinda feels creepy to imagine myself being listened to, I can't imagine any real consequences to my private conversations being heard.

However, I know that there are lots of people who do have those things they need to hide, and if only the people who need to keep things private work to keep things private, than the very fact that they are keeping things private becomes a risk factor.

Just like how part of the value of https everywhere is to prevent encrypted traffic from standing out, everyone maintaining privacy helps prevent people who NEED privacy from standing out.

Of course, as an individual, there is a cost for demanding that privacy - I lose out on the benefits of things like the echo and facebook. And since I am not an individual who needs privacy, there is no individual incentive to maintain it. It is a bit of a collective action problem.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by lemming on Thursday December 20, 2018 @07:33PM (#18730550)
Hey Alexa, do these symptoms sound like cancer?

"Sir, we have decided for unspecified reasons to suddenly decline your medical insurance. Have a nice day."

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by bzbarsky on Friday December 21, 2018 @12:52AM (#18731654)
Right, I have a hard time faulting people for deciding that they want to use voice assistants. That's more or less their choice. I am a lot more ambivalent about people who leave the voice assistants running when they have guests, because at that point they are making that choice for the guests too...

I think there's a lot of unexplored "how should/will society work" ground here, or at least explored only in science fiction, and it will be interesting to see how things shake out in the future. Maybe we will move to an "assume everyone is recorded all the time and put 0 weight on these recordings in anything that matters" world, for example... Hard to tell.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by matte_black on Thursday December 20, 2018 @06:01PM (#18730022)
If you live under a government where those examples are a reason to hide, then in the eyes of that government you are technically a criminal. Doesn’t describe my government.

Even under the most oppressive governments though, there will still be a sizable majority that doesn’t have anything to hide and can feel secure using most technology, and they’ll be fine.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by bzbarsky on Friday December 21, 2018 @12:48AM (#18731645)
First, having talked a lot to people who actually lived under a somewhat oppressive government (USSR, and by the 80s it wasn't even that oppressive), most people _did_ in fact have something to hide.

Second, just because it doesn't describe your government now doesn't mean it won't in the future, unfortunately. Consider examples of a 1920s German, or a 1960s Iranian (the old regime was oppressive too, but in different ways), or a 2000s citizen of Poland.

Third, there are certainly places where the danger is not from the government but from your neighbors, including to some of the groups I listed. So thinking about this only from the perspective of governments and criminality is off. Hence my claim that "only criminals have something to hide" is a false statement.

Fourth, I suspect that perception of how much one has to hide is highly age-dependent. As people get older they discover more and more things that they either want to hide or wish they could have hidden. Maybe I'm wrong in my guess as to your age, of course, but if I am not, I strongly urge talking about this sort of thing with people a few decades older. It can be _very_ eye-opening. Certainly was for me.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by matte_black on Friday December 21, 2018 @10:26AM (#18733835)
> Second, just because it doesn't describe your government now doesn't mean it won't in the future, unfortunately. Consider examples of a 1920s German, or a 1960s Iranian (the old regime was oppressive too, but in different ways), or a 2000s citizen of Poland.

This is the risk averse argument against certain technologies. If you believe your government won’t change and are willing to take that bet, you can lean into technologies very hard and reap the benefits.

Of course, if you think there may be a day where your government will change and use technologies against you, you could live out in the boonies and never even touch a computer, and thus get no benefits from emerging tech.

It’s a trade off between being at the bleeding edge and being as secure and private as possible. Personally, I have made my decision. Could it be my undoing one day if government decides I’m guilty of everything? Sure, but I doubt it will happen. I’ll take the bet.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by bzbarsky on Friday December 21, 2018 @12:41PM (#18734924)
As I said above everyone can make this decision for themselves, and should. It's just important to me to not paint any of the decisions here as "only criminals would do that"! Past that, I figure adults can and should decide these things for themselves.

That said, I also think we should work toward changing the nature of the tradeoff, e.g. by changing how voice assistants work to minimize the privacy issues. I suspect there's a lot of work we could do on that front while not compromising the functionality of the voice assistants.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by justinclift on Thursday December 20, 2018 @06:31PM (#18730208)
> Doesn’t describe my government.

... yet? :)

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by mokus on Thursday December 20, 2018 @11:10PM (#18731363)
> Doesn’t describe my government.

This mindset seems to be why the US political parties keep handing each other more and more federal power. Nobody can imagine their nation would be so stupid as to ever put the Other Guys back in power again.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by saagarjha on Thursday December 20, 2018 @05:14PM (#18729646)
I agree with the sibling comment, but just had to respond to this:

> The average person has nothing of interest to offer except more information about them in order to better perceive trends and distribute ads to them so that maybe they buy something.

This is a remarkably dehumanizing way of looking at people. You’re basically saying that people have nothing useful to offer except things we can use to sell them more stuff.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by mikekchar on Thursday December 20, 2018 @05:27PM (#18729755)
What would you say if the voice recordings were used to offer you differential pricing of items on Amazon? What if they profiled you and charged you 20% more because your speech patterns indicated you had more money? What if they sold this profiling data so that everybody charged you more? What if they shared the data with governments which ended up resulting in you not being able to get stop over visas, etc because you are and "undesirable" person to that government?

I'm not actually suggesting that Amazon does this right now, but it would be pretty easy for them to do so. People should be very worried about this technology and if they choose to use it, they should be absolutely sure the data is being used in a way that doesn't screw them over. Your boring data is absolutely interesting to people who want to abuse you. That's why there's such a big price on it!

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by mulmen on Thursday December 20, 2018 @05:20PM (#18729698)
> The only people who can say that are people who have good reasons to hide: drug dealers with multiple lines of business, professional black hat hackers, home grown terrorists, life insurance fraudsters, etc.

That this flawed and toxic thinking is so often repeated, especially in tech circles, truly horrifies me.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by summadat on Thursday December 20, 2018 @05:52PM (#18729946)
Ok, can I see your credit card statements for the last 5 years? Can I listen to all of your phone conversations? Can I watch you shower and use the bathroom? I mean, you sound like an average person with nothing to hide...../s
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by Izkata on Thursday December 20, 2018 @07:10PM (#18730424)
> Can I watch you shower and use the bathroom?

This approaches one thing I always wonder when this comes up: Are people with that argument really okay with their co-workers finding out what porn they watch and when they watch it?

It's perhaps a little extreme, but I can totally see it becoming a possibility due to large leaks like this.

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by NateEag on Friday December 21, 2018 @07:44AM (#18732971)
You are ignoring the possibility that people saying that don't watch porn. I don't.

Regardless, I disagree with the argument, as things you don't need to hide now can become things you wish you had hidden later (think of Jewish people in Germany in the 1920s whose religion and ethnicity were obvious).

Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by grkvlt on Friday December 21, 2018 @07:59AM (#18733029)
Sure. The only condition is that you don't share the information in public, on pain of massive fines and imprisonment - you can only use it to improve your internal business processes.
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by illumin8 on Thursday December 20, 2018 @08:06PM (#18730698)
I consistently hear this from the same people that own iOS or Android phones. You do realize that the mic on any phone produced in the last few years is also "always listening," right?
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by e1ven on Thursday December 20, 2018 @08:33PM (#18730818)
I hate this argument.

A) It depends on if you enable it. B) Just because you're willing to accept something in one domain doesn't mean you are universally OK with it being applied everywhere. C) I trust Apple much more than I trust Amazon.

[dead]
Re:Amazon Sends 1,700 Alexa Voice Recordings to a Random Person by dang on Sunday December 23, 2018 @12:42AM (#18744646)
Personal attacks will get you banned here. Please review https://news.ycombinator.com/newsguidelines.html and post civilly and substantively, or not at all.