News for hackers. Stuff that matters.
Re:Ask HN: Is anyone monitoring popular apps to check if the... by NikolaNovak on Sunday September 19, 2021 @11:23AM (#28585023)
"Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth"

It was my understanding that typically phone voice audio quality is a few kilo bits per second - not much more than a kilobyte per second. This would get positively lost in the noise of modern smartphone constant background connectivity, no?

(largely agree with your other points, though my understanding of original post was question for specifics on who actually may be checking these things rather than "somebody surely would've caught it")

Re:Ask HN: Is anyone monitoring popular apps to check if the... by PragmaticPulp on Sunday September 19, 2021 @11:31AM (#28585101)
> This would get positively lost in the noise of modern smartphone constant background connectivity, no?

If you’re only looking at total up/down traffic for the entire device, it might.

But we can inspect traffic per-app, including decoding the actual traffic (if you go through steps to circumvent certificate pinning).

Security researchers can, and do, look at the actual raw data coming out of apps. If voice was in there, it would be seen.

Re:Ask HN: Is anyone monitoring popular apps to check if the... by angelzen on Sunday September 19, 2021 @11:47AM (#28585262)
Average person speaks 16k words per day. Android considers app background traffic excessive at 50MB / hour, which is 1GB / day. 10% of that rate to steer clear of raising red flags is 100MB / day, about 10kB for each word you speak. Rather trivial to steganograph a word in 10kB of background traffic.

https://www.scientificamerican.com/article/women-talk-more-t...

https://developer.android.com/topic/performance/vitals/bg-ne...

Re:Ask HN: Is anyone monitoring popular apps to check if the... by fsociety on Sunday September 19, 2021 @12:10PM (#28585455)
You have to calculate the amount of data provided from all users in this case + storage + processing power to do all of that. It’s probably more than you would expect too.

The second point is why would a company do that? If the NSA or whomever wants to snoop on you, they’ll drop malware on your phone, subpoena your iCloud backups etc. not try to coerce a company to record people’s conversations when said company has no desire to do so.

Re:Ask HN: Is anyone monitoring popular apps to check if the... by reginold on Sunday September 19, 2021 @11:39AM (#28585184)
Any insight into how this was uncovered? A sports league secretly used their Android app's microphone to uncover illegal broadcasts.

https://www.techrepublic.com/article/laliga-facing-eur250k-f...

Edit: I was wrong, they were upfront with people about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-...)

Re:Ask HN: Is anyone monitoring popular apps to check if the... by PragmaticPulp on Sunday September 19, 2021 @11:46AM (#28585251)
Fourth paragraph of the article explains it:

> This functionality is not happening surreptitiously, as the app requests access to the microphone and geolocation service—it does not rely on a vulnerability to access these components without explicit permission

Users had to have the app open and grant the permission. They weren’t recording secretly in the background.

Re:Ask HN: Is anyone monitoring popular apps to check if the... by reginold on Sunday September 19, 2021 @11:48AM (#28585274)
edit: ah yes, I was wrong here, they were disclosing

Here's a better article on this: https://www.techrepublic.com/article/how-one-spanish-soccer-...

Re:Ask HN: Is anyone monitoring popular apps to check if the... by detaro on Sunday September 19, 2021 @11:42AM (#28585205)
there wasn't anything to "discover", the app literally was telling users that was what it was doing.
Re:Ask HN: Is anyone monitoring popular apps to check if the... by reginold on Sunday September 19, 2021 @11:43AM (#28585221)
edit: I was wrong, they were pretty up front with users about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-...)

From the article: "Despite this, users were not explicitly informed of the intended use of the microphone and geolocation permissions, which is central to the decision by AEPD to levy fines against LaLiga."

Sounds like they were spying while using microphone permissions, which is what the discussion is about.

Re:Ask HN: Is anyone monitoring popular apps to check if the... by detaro on Sunday September 19, 2021 @11:47AM (#28585266)
And they prompted people to opt-in (with somewhat leading language) into this system to search for unauthorized playback. So there was no need to "discover" that the app did that, because the app literally said it had a system to do so. There is a range between "secretly" (= would need research attention to discover it happens) and "done correctly legally".
Re:Ask HN: Is anyone monitoring popular apps to check if the... by reginold on Sunday September 19, 2021 @11:53AM (#28585322)
Thanks for this! Found another article where this is better explained: https://www.techrepublic.com/article/how-one-spanish-soccer-...