1) It's always listening for a keyword, and then it starts recording. It's a voice interface for a computer.

2) Your phone is doing the same thing except for it follows you around everywhere you go and records your map location, what apps you use, who you are talking to and what your web searches are. Your phone isn't recording just what you say...its recording what you do and where you do it and when you do it. It's overwhelmingly more pervasive and invasive if you value privacy.

3) The utility of being able to interact with a computer via my voice wildly surpasses the risk. Even if it had been my voice sent to this random other person all they would get is 3000 recordings of me saying "Alexa, what is the weight of an elephant?" "Alexa, play Magic Sword." "Alexa, whats the weather?" My father-in-law thought these things were the devil until he realized he could ask it to play ANY SONG HE WANTED and it would do it. Now he is always unplugging ours and plugging it back in on the porch so he can use it out there.

Literally every article about home assistants brings out a number of people who continue to say how they can't understand how people could have this in their homes. Great, you can't understand it. Meanwhile, an enormous number of people find immense utility in home assistants otherwise they wouldn't be proliferating so wildly for this long.

Point 1: Keyword triggers and is actually said are miles apart, as shown by the Alexa creepy laugh episode. There is no practical way of knowing when Alexa has heard a keyword and recorded content around it. Not to mention the Google play incident where a poor wiring job made the devices think the "enable assistant" button was constantly being pressed.

Point 2: My phone, an iPhone, offers a way to turn off the keyword-listening functionality - and presents this switch during initial setup. It also offers a way to turn off all tracking functionality. Apple has no financial gain from lying about this.

Point 3: This comes back to point 1. If you don't know what and when the assistant is listening to, you have no idea what phrases are being collected and shipped off. Also, there are plenty of studies floating about the internet about how "anonymized" search engine queries have been collected, studied, and in many cases paint very personal portraits of the people doing searches.

> There is no practical way of knowing when Alexa has heard a keyword and recorded content around it.

I know this isn't the kind of certainty you're looking for, but Google Home and Alexa both allow you to enable audio cues for when they start and stop recording. I find this helpful from an accessibility perspective, but the privacy-conscious may also appreciate the indicator.

They also have visual cues enabled by default. The light turns on when it is listening. You quickly get an idea of when it is recording and when it is not. And it rarely falsely triggers.

Point 2: Although you’re right about the application processor side of your phone, you cannot disable a significant amount of tracking functionality built into the baseband/modem. Your cell carrier or ISP can track you the same way that Google could on an Android device. On the other hand, iPhone basebands usually don’t have DMA, while other phone manufacturers allow the modem to access application processor RAM.

The iPhone has a lot less tracking built in and has much better privacy controls than Android with Google Play Services, but there are still some avenues for different companies to track you and to have a lot of control over your device.

Cell carriers can track iPhones as well through triangulation, etc. There’s not much you can do to prevent this.

You can simply turn on airplane mode?

Re: point 3, I was reading Kevin Murphy's book on Machine Learning recently and in it he says that roughly 20% of Google search queries that come in everyday have never been seen before. Reminds me of that report about Russian election interference campaigns that included the tidbit about Google being able to pinpoint the exact search queries that members of some GRU unit (Fancy Bear, maybe? idk) made.

> There is no practical way of knowing when Alexa has heard a keyword and recorded content around it.

This is incorrect. If you want to know what your device has heard and processed (or failed to understand), you can look at the Alexa app on your phone. It will tell you what it thought you asked for and what it told you or played for you, and you can replay the recording of your voice request.

You can opt out of basically every Google login/tracking in Android, except the Play store. I know because I'm logged out of everything and I disable location services. Google Maps keeps working.

What I don't understand is why they have to store voice recordings instead of deleting them once they understand the vocal command. There could be a number of reasons and I don't like any of them.

>What I don't understand is why they have to store voice recordings instead of deleting them once they understand the vocal command.

They don't have to. You can disable it at https://myactivity.google.com

try disabling Google Maps location access permission. For me it triggers an endless loop requesting Location permission, rendering the app unusable.

Google's always mining data behind the scenes and gapps are constantly phoning home, your "opt-out" preferences are meaningless.

This is one of those massive privacy violations that I cannot believe has been allowed to exist as long as it has without people making a concerted effort against it. I remember way back in the early days of Android when it was excused for reasons of allowing Google's live traffic mapping feature to work.

That excuse made sense in a time where public trust in these companies was justifiably high but it's turned into a situation where the major tech giants have the power to become a modern day Stasi on steroids (and increasingly show their willingness to play that role). We had to place enormous trust in these company's ethics (mostly on a subconscious level as they all used to go to great lengths to afford us the ability to implicitly trust them) in order for the smartphone/mobile revolution to occur. Now that these devices are a necessity in modern society, they've all dropped the pretenses that allowed us to trust anything to do with the information they're collecting.

We're living in a cyberpunk dystopia and I don't see an easy way out.

Fortunately OSMand works reliably (and offline).

It's to train their speech recognition and intent recognition systems. They probably also use the data to prioritise which queries they add support for.

>except the Play store

Workaround:

1)Install F-Droid (f-droid.org) 2) Install Yalp Store from F-Droid

Even if you do this, on a standard Android device, there is still Google Play Services installed, which has every permission available on your device. You have to install a fresh custom ROM like LineageOS without GApps to avoid this.

Good point. You should install LineageOS first, you can then select the GApps bundle size you need or try and replace them with FOSS alternatives. For me, Yalp Store has made using LineageOS + minimal, permission sandboxed google services a bearable experience.

> What I don't understand is why they have to store voice recordings instead of deleting them once they understand the vocal command. There could be a number of reasons and I don't like any of them.

Not that I have any insider information but a while back someone made a post on reddit about what baffles them about their work and they had a job where they basically listened to very short voice clips and saw something on the screen and they had to decide whether it was the right word on the screen or not.

There are tons of phone systems that use speech recognition and warn you that you are being recorded for quality assurance purposes. I would assume those recordings come from that type of system. Google and Amazon have been clear that humans will not be listening to the recordings.

Are you trying to say these home assistants are basically mechanical Turks?

Most likely the human verification is not in real time but for quality improvements after the facts.

In case you weren’t joking.

> Literally every article about home assistants brings out a number of people who continue to say how they can't understand how people could have this in their homes.

It feels weird to feel out of touch. I’ve been a computer/technology enthusiast my whole life, and used to proudly early-adopt all sorts of crazy gadgetry. But the older I get, the fewer things coming out of Silicon Valley appeal to me, and the less I understand the use cases. I just have to shake my head and accept that they are somehow useful to a lot of people and that the idea of a cool useful product is changing.

"Alexa, play [almost any recorded music ever]" is pretty cool.*

* You have to have Amazon Music Unlimited which costs from $4.99 to $9.99 a month.

I would love to have an always-on always-listening home assistant which did not ship my audio stream off to a cloud I don't control.

The fact that all the current listening assistants do ship the audio stream to the cloud has nothing to do with CPU power and everything to do with a desire to collect as much personal data as possible, and as far as I'm concerned they can pound sand.

I get 1) and 3), but I don’t buy 2). Your phone works with Siri/any other assistant off. The connected speakers don’t. So the comparison doesn’t hold in my opinion.

As an example for #2, when I got an Android somehow I was either automatically opted in or accidentally opted into location sharing. Two years later I found that Google Maps could show me every location I had been to for the last 2 years. I could review, day by day, everywhere I had gone, what time I went, how I drove there and where I went to next.

You can just mute the connected speakers and it's the same as having Siri off. Or get one of the ones that requires you to push a button (the Amazon Tap).

Many phones work the same way, the phone is always listening for you to say ok siri.

Can't you turn of this feature on iOS? I don't have Google assistant on on my device.

Yes, you can. It’s in Settings under “Siri”.

1) It's always listening for a keyword, and then it starts recording. It's a voice interface for a computer.

Show me the source code!

...all of it, including what's running the entire cloud behind it! Until then, fuck no, no hot mics in my house. And actually then, still no hot mics unless I've plugged my Les Paul into my amp, in which case I switched them on.

It's rock and roll. You don't get it, but somebody does.

1) Nobody can prove that. It's always listening and you have to assume always recording and transmitting.

2) My phone is a $12 throw away that speaks voice and sms (text).

3) Loose lips sink ships.

If we are playing the "you can't prove that" game, then you also can't prove that your $12 throw away phone isn't always recording, or that you new kitchen countertop doesn't have a recording device embedded in it, or that the maker of whatever device you are using to type that comment isn't breaking a plethora of laws to record everything you type or say or do around that device at any time.

It's reasonable to embed motive into these suspicions. My confidence in iPhone not listening to me is linked to the fact that Apple's ad network is a fraction of the size of Amazon's and Google's, and that to the best of our knowledge, it doesn't require extensive access to personal data to run effectively. Same with GE appliances and countertop makers. One of the most reliable ways for me to believe a company will not harvest my data surreptitiously, now or with TOS updates in the future, is for me to be convinced it's not in their best interest to do so.

True but...

1- Apple might not be interested in listening to its users but I'm sure other businesses are. Apple users are loyal customers who can pay twice for a piece of technology and some of them will happily spend a night in line to be able to do that. Most advertisers would pay big money to Apple to know who those people are and what they want; that information is like gold.

2- unfortunately advertisers aren't the only entity potentially interested in spying people.

> Most advertisers would pay big money to Apple to know who those people are and what they want; that information is like gold.

I think its laughable that this money would be tempting to Apple when they have a business that almost sees customers buying 700-1000 dollar plus devices on an annual or bi-annual subscription, especially when the privacy stance is one of the core pillars of the marketing message.

There is likely no commercially viable business model Apple could adopt to sell that data that would be remotely worth risking a 60-70 billion dollar a quarter in revenue money printing machine. That information is practically worthless in the context of iPhone revenue.

Should iPhone sales start to falter, this is absolutely something I would consider a concern, but the iPhone has a long way to fall.

At least you can pull the battery out of most "burner" tier dumbphones.

My battery falls out if I stare at the phone for too long. This works on goats, too.

When my throw away phone is transmitting, it gets warm. I also set it next to an amplifier and I can actually hear it bleed into the amp when it chats with the cell site. I can even tell a couple of seconds ahead of time when I am getting a text or a phone call.

And all a hypothetical "bug" needs to do is listen for some key phrases, and send a single byte or a few bytes of data across the wire, even through side channels.

I can imagine a system that throws an extra byte or 2 on those "chats" with the cell tower, or even abuses the timing that it decides to reach out and check the tower as the method of communication.

The actual voice recording and processing tech is small enough that it could be thrown right alongside the actual phone, for pretty cheap, and could run entirely separate from the phone itself, maybe even having its own battery!

Yeah, but you can also do the same with the Alexa device by watching it transmit data over the wire. If you think watching the transmissions is enough to prove your cell phone isn't recording, then it should be enough to prove the Alexa isn't recording.

Or not be sufficient in both cases.

> When my throw away phone is transmitting, it gets warm

Maybe that's just what they want you to think so you don't dig any deeper.

I vaguely remember rumors (or maybe it was used in a few court cases by the FBI), where carriers would turn on the microphones of 2G dumb phones remotely and silently. So your dumb phone probably has the same issue.

Carriers also keep records of where subscriber devices have been, so even if your phone doesn't have GPS, the carrier has cell tower triangulation logs of the device too.

ISPs such as comcast also save your browsing history to run their advertising networks, so that is also recorded somewhere too. And if/when net neutrality goes away completely, they might just sell that info too:

https://arstechnica.com/tech-policy/2017/03/comcast-we-wont-...

Whats even worse about ISPs doing it is how you usually have no other choices and it's your complete traffic stream!

Steve Gibson did a wireshark investigation of an Alexa, it is NOT always transmitting.

Your assertion that "nobody can prove that" is rather absurd.

there's nothing stopping from Alexa recording content locally and transmitting it with a traditional request once activated.

Also, there's no reason for Amazon to want a constant stream of Alexa data hitting their cloud services. The goal is to mine and extract valuable data about users to build profiles, ideally you'd want to do that on-device and send up the most valuable bits.

These are also capabilities they can silently introduce at anytime for any device.

Steve Gibsons "analysis" means nothing.

Except, you know, memory - of which these devices don't have a ton.

You can store around 1000 hours of recorded speech in a gigabyte of flash memory that costs $0.25. For most people, that could hold their entire conversational activity for a year. Storage and off-line upload (perhaps during a software update when packets are flying around anyway) isn't difficult.

They can not silently introduce new hardware to these devices. You should look into what kind of hardware these devices actually contain. Try to set up an intelligent, personalized data miner with those constraints.

Steve was not thinking this through. I can batch compress chunks of audio and lazy upload them when I think nobody is around. A listening device could probably even guess when you are not going to be using your internet connection.

You can filter the captured traffic for anything coming from Alexa's IP or mac, or transmitting to any amazon-owned server.

Sure, but you wont know what it is or why it is.

> Nobody can prove that.

You guys are way to paranoid. They're a public company and they are constantly under audit. They have explicitly stated in their white papers that the device has two computers, one that just listens for the "Alexa" keyword that activates the other one for signal processing.

Do you really think they would lie on those white papers? The government would be so far up their ass with fines it would be ridiculous. Not to mention people have actually done tear downs of the device and you can see the two computers and monitor the power input to each one as it runs. The "dumb" computer with minimal memory would be having to store hours of speech data until you say the keyword so it can transmit to the other computer.

Audits of controls are about ensuring the longevity of the business. They are entirely orthogonal to ethics or business models.

And yes, I am proudly paranoid. History and experience have confirmed the need for my paranoia for many decades.

> Audits of controls are about ensuring the longevity of the business.

You must not have suffered a SOX audit before. Part of the audit is technical.

Also, the SEC greatly frowns upon lying about your business.

I have suffered every kind of audit, many times. I know of many technical facets of every business I worked for that would never have been a part of any of those audits.

Do you know of any published Amazon audits that describe in detail what specifically around Alexa is audited, if anything?

Yes, but is that behavior changeable with only a software update?

It's not paranoia if you're right.

Actually, quite the contrary has been proven to point 1: both for Alexa (the spooky laugh episode) and Google Play (the "always pressed" button episode).

I almost think that the burden of proof that things aren't being sent is a valid expectation in this point. And that proof needs to be re-confirmed with each firmware update to ensure a bug hasn't caused the behavior to change.

Those aren't examples of the contrary, those are examples of in-precise recognition. That's miles away from being the same thing as "always recording".

And your SMS is logged as well as cell towers to which you connect. Is the “phone company” more secure than any other? If you really are someone in need of a tin foil hat, you should ditch the phone completely and communicate solely with dead drops and one-time pads.

SMS is actually clear text over SS7. I would not send anything I care about over it. It is also trivial to spoof.

All you need is 1 SS7 link and you can be any phone, kick anyone off a cell site, override call congestion and bump people off, change the display on your phone to any text, too many things to name.

Fun to watch the venerable "tin foil hat" lose it's luster.

> Nobody can prove that. It's always listening and you have to assume always recording and transmitting

Uh... packet analyzers, IP logs, bandwidth monitoring tools etc...

If instead of transmitting occasional bursts of data when you say the wake word it's been sending back tens of megabytes an hour, or tens to hundreds of megabytes a day, you can go "hey, it's probably transmitting everything it hears".

There are people that religiously watch what these devices are sending back just to try and catch one of the companies doing something fishy. There are people that religiously watch their network traffic period looking for something nefarious.

These devices aren't like your phone, where simply having it on can have all sorts of services/apps using data in the background or you open a webpage and tens or even hundreds of different servers are contacted and data pulled/pushed to/from them. It's a device that should be periodically checking for an update and sending very small audio files back in nearly-real time. If they were recording regularly, or especially all the time, and transmitting it back to a server it would stand out like a sore thumb.

Never mind the fact that keeping it secret, and not having a whistle blower, would be damn impossible. Someone's going to mention it to a loved one or friend, or flat out go online "I discovered my Amazon/Google device is actively listening and recording and sending to these IPs in these intervals" when they just know it as fact and didn't have to 'discover' it.

Which nobody can do. It is encrypted and unless the device accept invalid certs, they can queue up, compress, batch upload any data they want. They control the security, not the end-luser.

We know how much storage is on the device - we could tell thru network monitoring if they were actually doing this - there is just enough smarts in the device to only turn on the recordings when the wake word is spoken - thats not being said a malicious player wouldnt hack it, and insert their own code to listen all the time - but based on the evidence, I don't think amazon is that player.

Encrypted or not, an audio stream should not be difficult to identify.

If they batch compress and upload, it wont be a stream. It could be aes-256 lzma2 compressed chunks. Using the right codec, they could likely upload a hour of audio in a few hundred kbytes. I have seen some demos of highly bw optimized codecs.

Here are some staring points. [1] I would go with Opus. My voice chat server uses that.

[1] - https://stackoverflow.com/questions/167533/best-voice-compre...

> Using the right codec, they could likely upload a hour of audio in a few hundred kbytes.

But at the same time, you're convinced that you would notice if your phone was slipping out these kilobytes as part of its usual communication?

It seems to me that you've just arbitrarily picked a level of paranoia where you've decided that this can definitely happen with the Alexa, but won't happen with your phone. Your proud paranoia isn't applied consistently.

I am not convinced of anything.

The risk of the throw away device uploading my audio is significantly lower than a device powered in my home, with dedicated fast internet.

What if they convert speech to text like the American intel agencies do as proved by the Snowden and Vault 7 leaks?

That's possible but that's quite a bit of processing for actionable speech to text which means you have a chance of the device acting sluggish when you query it or you have to give the device way more processing power than it needs which increases cost and from my understanding with devices like Amazon's, they're already being sold relatively near cost because they are intended to get you to spend more money inside the Amazon ecosystem.

Can you MITM SSL the conversations to Amazon? It has memory. There is no requirement that it transmits in real time.

>The utility of being able to interact with a computer via my voice wildly surpasses the risk.

How?

Risks:

Willingly putting a proprietary device designed to listen to you and watch you, created by a company that exists only to maximize it's shareholders profits by either selling you things, advertising to you or collecting and selling data about you in order to do those first two things better, into your home to constantly watch and listen to everything that goes on.

Utility:

Control a computer by talking to it...

For me at least....that risk far outweighs whatever utility i migbt get by being able to speak to a computer and honestly, if i really needed it that bad i would just set up my computer with voice recognition and control software. It's existed for a while now. I remember playing with it when i was a kid...it sucked...but that was more than 15 years ago.

The only real novelty of alexa is that it'a a standalone box that answers you back.

This is exactly why we are building the first 100% on-device and private-by-design open-source Voice AI at https://snips.ai (and we have cloud-matching performances: https://medium.com/snips-ai/snips-brings-cloud-level-spoken-...)

Disclaimer: I'm a co-founder

We believe that people want more natural interaction and AI at home, but that it should never be at the cost of their privacy. You never know what a company, or hackers, could do with recordings from your home.

This is why we are creating AI which can work on a Raspberry Pi 3, and works in english, french, german, japanese, spanish, italian (more coming very soon)

Take a look at our blog if you want to build your own smart assistant: https://blog.snips.ai

Hey, your product looks super cool but I’m a bit stumped as to why you’re trying to force a token into it. It looks like it’s a simple payments token, which doesn’t usually turn out to be a great idea if you look at the remnants of blockchain projects that did the same in 2018.

Is this just a way to fundraise or do you have other ideas to make your product ‘decentralized’ aside from using a cryptocurrency?

For the record, everything else about the product looks amazing and I’m really excited to see an open and privacy conscience alternative in this space :)

Hi! Thanks! We are not so much forcing the token as realizing it is a technology which can answer some needs:

- it allows to build a really decentralized marketplace - it allows people to not share what are the apps they are buying, so to keep this private

Have you found that your users really want a decentralized marketplace vs what the one you've built already (which I think is really good!)? Additionally, remember that all transactions on ETH are public, so if anything transactions would be less private than if you were to contain them to a normal web2 marketplace.

Completely OT, but is the woman supposed to look that goofy/deformed?

https://imgur.com/a/DFgvNMt

Clearly the illustrator determined her head should be placed on backwards.

It got snipped and sewed back on with dental floss.

Are you working on making actual hardware like smart speakers?

I'm only asking because this would definitely help spread this kind of platform. Raspberry 3, despite being great, is not something the average Joe will mess it.

There needs to be a physical product with Snip.ai on it that people can put in their home. Something sleek and well designed, not some Rasp 3 in a case with some mic attached with duct tape.

We are working with partners, in the meantime if you want to hack, you can buy a MakersKit at https://makers.snips.ai !

I've made a fairly well-considered decision to use most of these new services. I keep virtually all of my content on services run by five major corporations because I'd rather have my entire phone's photos published on the front page of the Washington Post than lose all the photos of my kids. I'd rather have Jeff Bezos listening to everything happening in my house than have the more frequent trips to the grocery store that were needed before I had voice-controlled shopping lists. I'm not an ignoramus, I've just decided that certain things that are very important to some are not important to me.

I agree that the decisions that me and others are making are hugely damaging collectively but that is a different issue.

And you're not the only one. Outside of HN, in the real world, the average person doesn't set up a FreeNAS server or homelab for data storage, doesn't know how to do backups, and doesn't have nearly as much concern over privacy as the fear mongers here at HN, Reddit, and tech publications.

Fear mongering is nothing new, folks. The media is incentivized to cater to people in that way; this is why they use scare tactics and write BS articles like this one which boil down to "someone fucked up, sent the data for one customer to another customer". Furthermore, the article implies this mixup would NEVER have happened if the user's had not requested their data be released per GPDR.

The only valid question worth asking is this: are you willing to risk ANY chance of your data being compromised? Google/Apple/et.al. are not the enemy. For most users, convenience trumps security, and they will accept the minimal risk that comes with using services like Alexa and Google Photos.

FWIW, I've lost years of photos and data before on my first run-a-round with FreeNAS. It's not something that's just easy for the average user or even average developer to use and deploy reliably. I'm trying FreeNAS again now 4 years later, but it's taken way more work than I expected to understand my options and ZFS, and I'm still not sure I'll ever store anything critical on it.

> the article implies this mixup would NEVER have happened if the user's [sic] had not requested their data be released per GPDR.

OK, cool. So as long as I don't assert my rights under data protection regulations, Amazon probably won't orchestrate a grotesque breach of my privacy?

It's a mistake, man (or woman). Shit happens. ¯\_(ツ)_/¯

We have to expect as users of cloud software there is a chance our data could be compromised by BUGS or human error. I think that should be a given in any scenario. There's a difference between releasing data to third parties (or internal employees having access) as a matter of standard practice, and an unexpected breach or error in process leading to accidental disclosure of personal data.

As a reader, I am uninterested in articles about the latter. It's clickbait / doomsday journalism. The most interesting stories are those about grave errors in judgment/behavior and cases that indicate a company has routinely breached user trust. I do not agree that "employee mistakes" fall in that category.

I wrote this a little bit ago:

https://austingwalters.com/the-last-free-generation/

It's amazing to me that people are actively seeking to erode society as greatly as they are. The fact is, it's not better to have these systems long term. So what if it saves you even 10 minutes a day (which I highly doubt), if eventually someone comes to power that will decide to kill you and your families based on your prior beliefs.

Today we are seeing a more subtle manipulation of politics using all the data these large companies collect. I can't imagine what would happen if there was a concerted effort to "weed out" bad eggs.

There's some weird cognitive bias people have about visible vs invisible technology.

If they can't see it they're fine with it.

For example, if someone is walking in the mall they're being filmed by a dozen cameras.

But if you walk behind them with your own handheld camera photographing them they will get VERY angry and freak out and start yelling at you.

Yet nothing has changed...

Same thing with Facebook. People don't mind giving their data to Facebook but if Zuck was staring over their shoulders reading their email they would be upset.

Why are you baffled? They’re great little devices. I have two Amazon echoes.

Now that I can use my Apple Music, they are used constantly.

Voice-first devices are long overdue.

This is just my opinion, based on my experience and personality.

Voice first running entirely on prem with no internet connectivity, sure I would go for that.

Talking to the internet? No way. Not even if I had root on the device with the source code to the OS, firmware and applications.

> Talking to the internet? No way. Not even if I had root on the device with the source code to the OS, firmware and applications.

Can you explain how this is different from running your linux computer with a webcam attached?

Do you really think the people who are concerned about Google Home/Alexa/etc don't also have their webcam covered with a sticker?

I don't leave a webcam attached, or a microphone.

I can also debug any code running on my machines and have some idea of what they are doing. I can also limit when they are allowed to talk to the internet and to what address.

> Not even if I had root on the device with the source code to the OS, firmware and applications.

Can't you debug code and control network access in that scenario?

Maybe if I have the debugging symbols and kernel headers. Even then there are circumstances where it won't help.

For example: Nearly all cell phones check in to their manufactures website from time to time. Nearly all of them look for a header that triggers a debug mode that turns on CarrierIQ. (It isn't called this any more, AT&T renamed it to an empty name to stop people from searching for it).

Trying to find obscure functions and understand how they interact with the servers they check into can be very difficult at best. It often leads to more questions than answers, at least based on my experience.

I guess you’ll have to wait another decade or two.

In the meantime, I’m “feeding” my devices every day.

Hopefully voice-first becomes a solved problem, and you’ll get your device sooner.

What's funny about that is, I had voice recognition software in 1991 that could start up any application on my computer, reboot my computer, etc. Surely there must be a small device with the processing power of my old 386-DX40.

I believe it was made by a company called Covox or something? There were several other companies that made similar software back then.

Could your device recognize multiple speakers, with varying accents and grammar style?

Yes. Not very well, but yes. Each person had to say a few sentences. This is fine for home use unless you run a halfway house.

Certainly not as well as the software we implemented to listen to phone calls in the background on wireless networks in the mid 90's. That was the wildfire project and was fun. We abandoned it, since our lobbyists were able to kick the hands-free laws down the road.

>Voice-first devices are long overdue.

Sure, that's not really anything that anyone disagrees with. It's the acceptance of data collection and exfiltration that is odd.

I would disagree. I despise voice interfaces and despite working for one of the major tech companies that build these devices and interfaces, I use exactly zero. I do trust my employer to do it correctly based on the processes I witness every single day, but I don't own any because I don't like voice interfaces. Remote control on my phone, sure. Clicking the button to change a song, sure. But no voice, thanks.

You dislike the very idea of voice interfaces or the current state of voice interfaces?

Maybe a naive question, but how are they any worse than having phones with non-transparent hardware/radio drivers in your living room? We seem to have accepted that risk, and even carry phones around everywhere.

We use smartphones for the same reason we don't avoid any non-free software like Stallman: a huge amount of additional possibilities. But what Alexa, Siri etc. offer is just a different way to use a limited set of existing features, in exchange for a much higher risk of a privacy breach.

Everyone needs to draw a line somewhere, I just don't see a reason to use voice assistants, definitely not with internet connectivity and where the company keeps all recordings for some reason.

They keep all recordings because they train their voice recognition off them. GOOG-411 kept all recordings too, for the same reason, as do hundreds of other services, but I don't recall anyone caring about them.

Google gives you a UI to view and delete your recordings and suddenly they're monsters.

Has anyone on HN put their phones into Airplane mode with WiFi on and then had wireshark tracking all outgoing packets from the wifi devices in their home?

To see exactly what outbound connections were made by which device and which app when either device was being actively used, or laying dormant?

This is how it was discovered in the UK that SmartTVs were sending viewing data....

"He thought of Alexa with its never-sleeping ear. They could spy upon you night and day, but if you kept your head you could still outwit them."

The irony is the ability for mass survelence (by unelected corporations) is far more than they had in 1984

We've settled the 1984 versus Brave New World debate with the answer "yes, please."

A number of years ago, The Onion did a great parody piece [1] on how Facebook is ran by the CIA

[1] https://www.youtube.com/watch?v=eiPaTy2iJTM

https://www.marketwatch.com/investing/stock/fb the title for the stock is: "Facebook Inc. Cl A". With the particular font they use, the lowercase "l" and uppercase "I" look the same.

They get a kick out of the whole revelation of the method thing.

> I am baffled by how many people have no problems adding always listening and recording Google and Facebook devices to their living rooms.

To be less baffled, think about how many of us have those devices under a different name: Our phone.

Functionally I do not see the decides any differently. Yet, I think everyone I know has an Ok Google, Hey Siri, or Ok Bigsbi (however you spell it lol).

I'm not going to lie, for some reason Alexa makes me more concerned than my phone. Yet, the logical part of me fails to see a meaningful difference between my phone and an Alexa.

Disclaimer: I own an iPhone, I do not own an Alex/HomePod/etc.

Hey I’m right there with you. I keep voice assistant disabled on my phone FWIW and my girlfriend and I both refuse to have voice assistant devices in our studio. Our upstairs roommates have the whole top floor of the house bugged. They mostly use it to turn on and off the lights. Downstairs we also have Hue lights but we use the app. I’d love a locally hosted assistant but I’m busy with so many projects and it’s low on my list.

> Some are considered tech people who should know stuff like this could happen, but they just don't care or don't think it will happen to them.

It's this thing where you somehow believe that just by being an expert in some field, bad things in this very field can't happen to you, even if it's out of your control. Like a brain surgeon suddenly getting a tumor in his own brain.

This. You're trusting everything you say & do to a company who says they're not going to share your data with others and that have the proper control in place to prevent other people from getting it.

Yeah, it's like volunteering to become a serf.

The stasi kept the data protected better than a lot of tech companies as well.

1) The devices are useful.

2) The chances of a mishap like this happening to a single user are very very small.

3) Even if a mishap like this occurs, the chances of it causing meaningful harm for most people are small.

The fact that you are baffled by this phenomenon says a lot more about you than it does about users of these products.

Saf thing is, some current officers are thinking “oh nice. Lets find ways if exploiting this opportunity, by finding security issues on these devices, paying these corporations to allow us to sneak in their devices it any other means necessary to use these amazing machines.”

If someone has one of these in their house I will leave. Recording without permission of all participants is forbidden in many places anyway.

I do as well. I used to politely ask they unplug it, bit invariably there were more in other rooms. I just explain my concerns, and avoid those people if they cannot grasp or honor them. So far it seems a good strategy, as I have doged a few 'bullets' both security-wise and socially.

Yeah, I'm extra happy I have my Amazon Echo now, if it also works as a way of preventing paranoid conspiracy-theorist lunatics from interacting with me!

If there is one thing you could have learned from the post Snowden era it is that your paranoid hacker colleagues may (1) know more than you do and (2) tend to be right in the longer term about what you today consider to be ridiculous lunacy and (3) usually are still too mild in their delusions compared to reality.

Astonishingly, people are able to do tricky trade-offs. They trade privacy for utility in this case. What’s wrong with that?

And somewhere there's an active intelligence officer ready to respond "thanks!"

I sniffed the packets and didn’t find anything particularly worrying.

Because it doesn't matter. Human error. Will be fixed.

Ha. Sure. It's going to keep happening, and on a larger scale. Then people will (again) aruge it's no big deal. Stil relatively early in the conditioning stage.

Perhaps the source of your confusion lies in your misunderstanding of the actual risks involved.

A good indicator of that is your reference of the Stasi.

>I am baffled by how many people have no problems adding always listening and recording Google and Facebook devices to their living rooms.

I am baffled by people that think anyone cares about their conversation about Jeff at work or what Monica and Ross just did on the 75th viewing of an episode of friends, or that they talk to their stuffed rabbit named Bun that they've had since about a week after they were born about how miserable their life is and how they should just pack up and run away together... I mean...

"oh no, big bad google knows I shouted 'oi shut the fuck up' four times instead of three at the neighbors today" and "oh no, Amazon knows I asked what we want for dinner"

I guess I must be weird and other people are having extremely sensitive, if not classified, conversations in their residence but I just don't see what the big deal is.

Most of the people I personally know that find it bizarre people would have such a device have rewards cards, smart phones, take every damn quiz that myspace and facebook have ever had, checked in religiously with foursquare, tag their friends in every photo they upload seven times a day from every place they've been that day, check in everywhere they go on facebook and have 2+ streaming services monitoring every single thing they watch. Like, hellloooooo you're worried about a microphone that can't even get "hey alexa" "hey google" right half the time and actually trigger?

You know, if nobody cares about this, then why are people constantly up in arms whenever yet-another-Facebook-privacy-scandal surfaces?

Why people object to have e.g. their financial or medical information disclosed?

Yes, there are people who are "sheep" in the sense that they would do anything if there is some voucher or discount for it. But most people would also object to a camera in their bedroom or photos of their kids being posted publicly online for everyone to see.

You are right that most of the stuff is absolutely mundane, especially in isolation. However, with a bit of analysis one could suddenly learn things about you that you would likely want to keep private - e.g. your sexual fetishes, whether or not you have some illness (insurers and some employers would kill for such info!), your political views, ton of data about your interests, which TV shows you are watching, etc. That's an absolute bonanza of data that makes any marketer salivate and see dollar signs. And a gold mine for all sorts of stalkers and creeps too.

> then why are people constantly up in arms whenever yet-another-Facebook-privacy-scandal surfaces?

People are not up in arms. Some group of media and tech people are up in arms. Most do not care. Heck, most do not even hear about the latest scandal.

>then why are people constantly up in arms whenever yet-another-Facebook-privacy-scandal surfaces?

Who? Leo Laporte? Kara Swisher? Talking heads on cable news? It's their job to be shocked and outraged.

> then why are people constantly up in arms whenever yet-another-Facebook-privacy-scandal surfaces?

Who is? Outside of HN I haven't heard a single thing about it. People don't care.

"Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say."

What's baffling is how many times this same conversation has played out and people like you still don't get it.

There is a difference, though. I agree privacy is important as a principle, and we need to protect the right to it. But privacy is also not important to me, so I can use services that require me to give up some of it. I want people to be able to maintain privacy if they want to or need to, but I might not care about giving up my own.

I am baffled that people like yourself are not concerned in the least.

I grew up in an Eastern Europe Communist State where this kind of personal surveillance was the norm. People went and wrote down all their interactions with others. You can see these documents now as the former secret police archives were published (what wasn't destroyed to protect the higher ups).

It's amazing how the most innocuous remarks can be used against yourself in an unbelivable twists. Just an example: Person A criticized person C, which was his boss, as being incompetent, to person B, which was a secretly delator. Person B went and reported to the secret police this tension, as he was payed on the number of pages he would write.

The secret police compiled a weekly report of stuff that would happen, in each company, and send it up to the party for review. It just happened in the party that somebody who saw the report had frictions with that Boss, and he used that report to push the Boss around. The Boss thought that person A himself wrote the report, and used his connections to get person A fired, and banned, on the party line, from ever having a qualified-work position again - ie he could not be an engineer, teacher, or anything, leaving him with just construction work or janitorial jobs.

How often do you bitch about your boss? How would you like that your boss gets reports about what you bitch about him in your own home? How would you like that what you say, no matter how private you want it to be, is always recorded?

I'm astounded by the fact that people see nothing wrong having these devices always listening to them.

Because your phone, or computer, or tablet can record your voice and far worse.

>I am baffled that people like yourself are not concerned in the least.

>I grew up in an Eastern Europe Communist State where this kind of personal surveillance was the norm.

Do you feel the same about smartphones? They record location, are capable of recording audio and video, if you have wifi and/or bluetooth on they can record every device ID you come within range of, they can in theory record everything you do in every app you use.

Don't get me wrong, I recognize the surveillance value/implications of such devices. As Pokemon Go was starting to initially gain popularity I even wrote a piece showing how such an app would be extremely useful as a tool for HUMINT.

TLDR: You create a game location, like a gym, in an area you want to surveil or deploy a rare spawn in a location you want to surveil. You then sprinkle it out on social media geo-targeting, then people flock to the area with their app that already chew through data and point their phone's camera all around the area giving you video and audio that you can either pull in real time at a risky data-cost or grab still images and then decide if you want to compress captured video and send it or leave it uncompressed and upload when the device connects to WiFi next.

Here's the post https://www.ryanmercer.com/ryansthoughts/2016/7/11/pokmon-go... and please, 'pokemon go funded by the CIA' was not something I believe then or now but there is a direct connection to the U.S. intelligence community via funding John Hanke received for a previous company.

Using a reward card and taking FB quizzes are active decisions. Being surreptitiously recorded is not.

Well, they made an active decision to buy a device specifically meant to record them and provide responses to said recording. It would be another thing to find out a phone records every conversation passively, but these devices are literally made for the purposes of recording you.

That kind of sounds like a self inflicted wound if they actually cared about privacy.

This is all said with the presumption that the devices actually are surreptitiously recording. Which is far from proven but already addressed by other comments here.

OK, by your definition of "recording", a laptop contains several I/O devices that "record" my input, not just webcam and microphone, but keyboard as well. I guess I should just shrug at the revelation that it comes with a keylogger. Because hey, if I didn't want my written thoughts to be recorded, why did I buy a memory-enabled Internet-connected device to do actually that?

Don't put words into my mouth, I never said that.

I even used the example of a phone recording you being bad because that wasn't the primary purpose of the device when bought. That argument obviously applies to laptops for the same reason.

But if you as a consumer decide to buy a device who's literal only purpose is to record you, then you don't also get to cry out about it recording you. That's the very definition of a self inflicted wound.

The primary purpose of an Efho device is not to record you. You brought up a silly argument.

It has 7 microphones and its only purpose is to record you, then respond to your request. That's literally the only thing the device is made to do.

And a laptop has a keyboard and memory to explicitly record what you write. That doesn't make installing a keylogger the same thing.