The way I read that is, only one of the apps actually sends audio data to the server when the mic is muted. I'm not sure why they don't say which one, and I'm not sure what is meant by "occasionally gather raw audio data" but it could be as innocuous as the mute button not updating and a half second of audio being sent before muting starts. Nobody is building a machine learning profile out of that.
The real story here should be that one app where the mute button doesn't actually work. The others are all operating normally as far as I can tell.
Yeah, that's very annoying.
Zoom, for example, will tell you, when you are muted and you begin to speak. It's a very nice thing.
I have a microphone (that wasn't expensive) that has a hardware mute. I use it when I really want to make sure I'm not heard, even for "speaking" detection.
MS Teams has that feature too.
TBH I'm not surprised: when you mute the mic in an app, you're still letting the app in control. If you really want to be safe, you need to mute at OS level or in hardware. That's why cameras have a hardware cover in modern laptops.
> How about we not make the default that companies can do whatever they want and users have to take steps like a hardware-muted mic (which isn't always an option) to ensure a basic expectation of privacy?
Sounds nice on the surface, but is ultimately silly. Sure, it'd be nice if everyone did the right thing, but you can never guarantee that, and hence if you really care you need to perform the mute at a lower level than what the app has access to.
And the increasingly (or is it just perceived?) shady behavior of big companies are not helping.
I am afraid this eludes our leaders across the board.
It would be so nice to have a mute-mic button which lights up when muted.
Most of the actions just duplicated existing UI elements.
So when you go to the deck to perform an action, you mentally context switch away from the keyboard, so your brain is looking for different clues.
So even with a touch bar + function keys, the function keys stay in keyboard context, but the touch bar requires that switch in any case. Maybe taking your eyes to the touch bar is enough of a context switch, mentally.
The problem was that it was too much of a tradeoff. Either a touch bar or function keys. I need function keys. The touch bar was useless for this purpose (no tactile feel).
Apple could easily have done both. There's more than enough space even on the 13" macbooks. It would have taken a bit of space from the vertical range of the touchpad but it's already comically large anyway.
I carefully made sure I didn't mention the touch bar. I waited until 2022 to finally be able to buy a MBP without a touchbar (and with magsafe charger).
I would very much like a physical button with a reassuring tactile feeling to it. Like the mute button on the function keys row.
The mic mute button of course works at the OS level but still...
Zoom was discussed 2 months ago in "Why is the Zoom app listening on my microphone when not in a meeting?"
For libel and slander cases though, telling the truth is a valid defense.
Which is neither here, nor there, as some are more likely to sue you than others.
>For libel and slander cases though, telling the truth is a valid defense.
Which is neither here, nor there, again. Not everybody wants the hassle of going through a lawsuit or the time and money costs associated, even if they have a "valid defense".
Should i hazard a guess, it would be either Zoom or Teams.
As well as, I assume, to archive a text indexable/searchable log of your conversations. I say this latter part based on multiple experiences I've had receiving clearly targeted advertising for topics I make random passing jokes or commentary about in live conversation, but which I've never once searched, click-imprinted, etc. for online. But, this is purely suspicious speculation. The live closed-captioning feature is a real thing and a thing I could absolutely see resulting in Google always sending audio streams to their backend for.
It makes some sense here on HN where people often post under their real names and want to think carefully before badmouthing a former employer, or otherwise picking a fight.
I agree that journalists have little excuse.
Except wanting anyone, ever to talk to them again about something controversial.
Bob Woodward has gotten PLENTY of high level politicians to talk to him candidly even though he's publishing what they are saying often in an unflattering light.
If someone as famous as the watergate guy can STILL get politicians to talk to him, what does a random journalist have to fear?
I mean, FFS, the gamer nexus guy got newegg to talk to him even after blasting them about ripping him off and letting them know "we are recording everything".
Journalists are acting like a single inkling of a bad word said will lock them out of access to everyone everywhere. The truth is, there are so many journalists out there that one could make a career of asking hard questions and publishing unflattering statements and the STILL would likely not be recognized by most individuals if they asked for an interview.
Woodward is absolutely one of the few exceptions, if not the only one.
He publishes on a long timescale with dozens of sources, not a short timescale with one or two.
So everyone knows the story will come out but not immediately, and everyone knows everyone talks to Bob.
But like it or not, most (not all) of the people he talks to have less to lose, because they are at or close to the apex of power in DC; there will always be jobs for them elsewhere in the USA, in a thinktank or on a board somewhere.
(It's also worth noting that Woodward's most famous source was anonymous for essentially his entire life)
In the real world outside seats of government, talking to a journalist on the record about stuff you should not often means you are the single source -- the only person who made the unflattering or damaging story possible, in a story that maybe won't wait even a week to be published.
It puts you out there on your own, gets you fired, makes it difficult to get immediately re-hired, and I suspect for an American with a family in an at-will state makes telling the truth on the record a luxury they can't afford.
Nothing about that situation has bearing on whether people first think of safely concealed sources or being publicly dragged through the mud like Chelsea Manning and Edward Snowden before sharing things far more important than entitled rants about customer service for entertainment-related products. My lord.
Why not finishing their research first, discussing with lawyers how not get sued, and contacting the company about it so that they can fix it or comment on it, and only then publishing the proper, responsible research that is actually useful to someone?
People can be irrationally attached to the things they use.
As a farm kid growing up, you didn't step between two guys arguing the merits of I-H and J-D farm equipment (1970s...)
It is doing this for the ultrasonic room detection feature, which can be turned off.
You're reading it incorrectly.
The paper outlines that as far as they can tell Webex is not sending audio when the mute button is pressed, but is gain and other parameters, based on this audio. And this has been reported to Webex, and they are investigating.
There should be a line between "companies doing whatever they want" because of some implied "nefarious" reasons, and "companies doing whatever they want" because their customers want a better experience even if it has security/privacy implications.
So sure, Teams gets some things right, UX-wise, but for every "notify the user if they're speaking while they are muted" there's a "randomly scroll the chat back down while you're looking through history", a "randomly make it impossible to erase a link with backspace in the chat box" or a "don't let people see who is participating in the conference", and there's little incentive for them to avoid crap like it and avoiding whole categories of bugs because people are buying it for other reasons.
For the vast majority of users, price beats UX. If a company can keep their app free by selling user data, they will out-compete paid alternatives, regardless of the UX.
Is Zoom audited? Zoom had been lying for about having end-to-end encryption, for example, until they were caught by the US Federal Trade Commission. Surely, something like that would have been discovered earlier in an audit, if they were audited and the audits were worth something.
They were also sending data to third parties like Facebook and Google through their SDKs.
https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-use...
https://arstechnica.com/tech-policy/2021/08/zoom-to-pay-85m-...
There are so many alternatives, how is it Zoom has any business at all?
Zoom was the first videoconferencing software I experienced where the first 15 minutes of the meeting was not spent with "can you see me," "can you hear me," some people falling back to dialing in to a speakerphone, and one or more out-of-band calls to various participants to troubleshoot problems.
Zoom was click a link. And it worked. Nobody cared much about anything else beyond that.
There are only two videoconferencing platforms I've never had any problems with: Zoom and Google Meet. I don't trust either company, but sometimes you just have to get your work done.
I often call it "golf-course-ware" the sales person goes golfing with the executive, they discuss features and prices and discounts ober the match and the executive typically doesn't have to use the software but only their employees or the assistant.
Interestingly Zoom for me was a game changer in usability and it spread during pandemic, when executives where at home partially without their physical conference room with video conf setup and without assistant.
Anecdotally, privacy/security seem to be on the bottom of the stack. Platform support and necessity for work are above them all.
1. When the mic is soft muted, information is getting sent to the conference provider which could leak information about private matters.
2. When the mic is not muted all information is definitely going to the conference provider in a way they can decrypt so they can mix it.
That is to say that when using most conference software, you have already granted then access to contents of the meeting.
If you can't trust them to not miss use information they get when the mic is off, then you also can't trust them when the mic is on.
https://mashable.com/article/signal-end-to-end-encrypted-gro...
Jitsi has supposed e2ee videoconferencing (on Chrome - they used some chrome-specific API for processing) for (I believe) at least a year or two.
Element has native E2EE for 1-to-1 calls, but uses Jitsi for group calls. Native E2EE group calls actually also exist, called Element Call (https://element.io/blog/introducing-native-matrix-voip-with-...) but they're yet to be integrated into Element and specced into Matrix, I believe.
I don't believe this could be true, and the linked article doesn't have the word "mix" anywhere. I imagine that there is no mixing happening until after decryption on the client device. Of course this means that every audio source goes to each recipient discretely, which means more bandwidth, but audio (especially near-silent moments therein) is lightweight enough for reasonably sized groups. Obviously this same n^2 scaling issue happens with the video anyway which is never mixed.
More info is available at my blog post about it: https://signal.org/blog/how-to-build-encrypted-group-calls/
I manage some properties for a family member on the side, one of which is in a very bad neighborhood. When I travel to this neighborhood I have a certain state of alertness that I would not normally have in my boring suburbistani neighborhood. This is better known as "situational awareness" - the man approaching me in my own neighborhood is likely a just having a friendly conversation, the man approaching me in bad neighborhood is guaranteed going to at least try to bum a smoke off me, which I don't have as I don't smoke, and will likely act belligerent if I refuse to give him money as a follow-on to the request for a smoke.
Contextually, I expect a video conferencing software to be listening to and watching me even if it doesn't necessarily reflect in the UI, it has the capability and is actively meant to do so. As such, I explicitly don't have any form of sensitive conversation in the vicinity regardless of status. On the other hand, I do not expect it to do so when not running nor my laptop to do anything similar.
Perhaps there is a legitimate criticism to be made here of poor UX around "not listening" - but to paint this as an "extremely concerning" issue is sky-is-falling critique. This over-the-top concern seems further alarmist in that both my laptop and phone display clear and obvious warnings to the user when the microphone is hot.
But that's true for literally all applications running on your computer. Evil software running on your machine can do all sorts of bad things.
The problem, as reported in the article, is that apps are not making use of the OS mute, but are instead still reading from the microphone, and some are even passing the readout to their servers.
This is why I personally insist on using the web version of streaming software over an installed binary.
Because they're not actually doing that?
These researchers did everything they could think of to come up with the most concerning headline.
I imagine someone, somewhere is going to make a video conferencing app that closes the audio interface every time you press mute. I also expect few people will use that option because it adds additional latency every time you unmute.
I want my mute button to work ASAP and I don't believe Zoom (or anyone else) is interested in whether or not I'm eating while muted.
>> Applying the classifier to the type of telemetry packets the app was sending
Are you sure they’re not? The used these algorithms on telemetry packets sent from browsers. I see no reason to give companies whose revenue is built on ads the benefit of the doubt here.
Besides - is it really super valuable to know that while I (thought I) was muted that I was cooking? Zoom's going to find out I... eat?
If they are, the continuing video feed is pretty likely to answer their question.
But the detectives with a search warrant are pleased to be able to listen to your private conversations.
The secret police who do not need a warrant (or legality) are glad to be able to listen too.
The staff at Zoom are happy to spy on you, probably, for a small reward.
A proper mute removes those concerns. A mute that does not mute is inviting a lawsuit
The technical cost of deploying this is probably large, and the cost to reputation immense if they were caught doing this. By comparison, giving people the additional sense of privacy by actually turning off and on the mic is likely more than outweighed by the annoyance of lag between turning on and off your mic and being heard by the other chat members.
Although they could do something like write random bits of audio to the stream when the mic is muted in software. That'd at least let users know that the actual audio isn't leaving their device. But the hardware peripheral activation is probably not going to go away.
You're implying government policy for how companies operate in this area... Which is worth pursuing, but we all know that usually ends up half way effective, requires a cat and mouse game of auditing and enforcement, or big companies playing fight club math with the fines.
Even if this was already the case for this particular issue, as users we end up never really being sure if a company is violating that particular requirement.
> users have to take steps like a hardware-muted mic (which isn't always an option) to ensure a basic expectation of privacy?
This should be the default, just like how operating systems and networking evolved over the past 30 years starting with a "trusts everyone" attitude towards a "trust no one" by default. We need to assume most companies are potential bad actors, the hardware and software that comprises the basic operation of our device needs to provide the user with facilities to control flow of information separate from third parties, especially when it comes to input devices. In the case of microphones and cameras hardware switches should be the norm, or at minimum indicator lights.
This could also quite easily be a government policy for hardware vendors, and I suspect it would be more effective... It only has to reach a threshold after which users expectations shift to force manufacturers hands, so it's direct effect need not be as comprehensive to be effective.
There are also laptops with hardware microphone switches (eg. https://puri.sm/products/librem-14/ or https://frame.work/).
> The researchers then decided to see if they could use data collected on mute from that app to infer the types of activities taking place in the background. Using machine learning algorithms, they trained an activity classifier using audio from YouTube videos representing six common background activities, including cooking and eating, playing music, typing and cleaning. Applying the classifier to the type of telemetry packets the app was sending, the team could identify the background activity with an average of 82% accuracy.
How is this not extremely concerning for anybody who cares about privacy?
How about we not make the default that companies can do whatever they want and users have to take steps like a hardware-muted mic (which isn't always an option) to ensure a basic expectation of privacy?