News for hackers. Stuff that matters.
Re:Ask HN: Is anyone monitoring popular apps to check if the... by dylan604 on Sunday September 19, 2021 @11:45AM (#28585242)
>Recording and interpreting speech would require a lot of CPU (if done on device)

Does this include the newer Apple Axx series units with increasing number of ML cores? Siri is supposed to run locally on device. Hardware is moving explicitly in this direction. If this is done locally, no actual voice data would need to be sent down the wire. Insstead, a small compressed bit of text on keywords could be sent whether that's immediately or saved up until user foregrounds the app. No tinfoil hat needed to see how your premise is pretty weak.

Re:Ask HN: Is anyone monitoring popular apps to check if the... by PragmaticPulp on Sunday September 19, 2021 @11:52AM (#28585311)
> Insstead, a small compressed bit of text on keywords could be sent whether that's immediately or saved up until user foregrounds the app.

Which would then appear in the packet captures that can be performed on the traffic (after circumventing certificate pinning).

My premise wasn’t that each step was impossible. It was that many steps would have to take place without being detected anywhere along the chain.

Re:Ask HN: Is anyone monitoring popular apps to check if the... by dylan604 on Sunday September 19, 2021 @11:57AM (#28585350)
How do you distinguish the, assumed, encrypted transmission from a foreground app sending this data compared to just requesting an update for the app's viewport?
Re:Ask HN: Is anyone monitoring popular apps to check if the... by hutzlibu on Monday September 20, 2021 @04:00AM (#28591310)
With a fully reversed engeneered app, this would be possible. But I believe the effort for this is quite high. And with obfuscation even higher.
Re:Ask HN: Is anyone monitoring popular apps to check if the... by b3morales on Sunday September 19, 2021 @01:23PM (#28586095)
> increasing number of ML cores? Siri is supposed to run locally on device. ... If this is done locally, no actual voice data would need to be sent down the wire.

Surreptitiously taking advantage of what you describe would be restricted to Apple, which is its own concern but a different topic than what we started with, which is 3rd-party apps.