They're probably not doing it through smartphones, since the leaked slide deck never actually directly mentions the devices they're using to listen in on people only stating they're "smart devices": https://www.documentcloud.org/documents/25051283-cmg-pitch-d...

It is much more likely they're listening in using the microphones in smart TVs, which have much weaker privacy protections. This would also make sense since Cox Media Group is a broadcaster, thus they're much more likely to have broad access to data from smart TVs than from smartphones.

This makes way more sense.

So AdGuard DNS to the rescue?

Firewalled LAN segments with no internet access, rather.

I have been using NoRoot Firewall since my day1 with Android. It takes some times but I allow the least amount of rules per app, then block . per app, and block globally the ones I identify (trackers etc.)

I also block 31... range globally and the FB and FBCDN addresses (namely)(but I don't use FB/IG/WA anyway)

Which one? Do you have a link, I'd like to try setting it up for myself

google search that badboy, my man

or just don't connect devices with lax security or privacy to the internet.

Just so we're all clear, the question about facebook and phones specifically is not new..

2016: https://qz.com/697923/heres-how-to-stop-facebook-from-listen... https://www.independent.co.uk/tech/facebook-using-people-s-p...

2018: https://money.com/how-to-turn-off-phone-microphone-facebook-...

2019: https://newatlas.com/computers/facebook-not-secretly-listeni...

None of those articles provide evidence and the last article mentions how difficult it would be to hide such activity on a smartphone due to power and data constraints. A smart TV has none of those issues.

It does, but I doubt most people care about the unnoticeable tiny little green icon in the corner.

Frankly, I don't believe it. You can't hide the fact that packets are being shoved over the WAN. Somebody would have picked up on it.

From a quick search:

"Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition," Samsung posted in its SmartTV privacy policy.

https://money.cnn.com/2015/02/09/technology/security/samsung...

There's nothing to hide, it's part of the way the TVs work and explicitly stated by the manufacturers.

But usually you would have a wakeword that is recognized locally or a button that has to be pressed before online speech recognition would start.

>There's nothing to hide

Sure there is. I would expect a feature called "Voice Recognition" would only be active when I was using voice commands (and perhaps the occasional accidental activation), but not at other times.

> would only be active when I was using voice commands

How would you activate certain voice commands if it wasn't listening to all?

If the microphone was off than it has no way of hearing and activating the commands. So by design it's microphone needs to be on 24/7.

You could have a push-to-talk button on a remote control to enable the mic but than you just might as well use the remote control.

All these talk to activate features are designed only for the sake of being gimmicky and unethical surveillance.

I think amazon solved this partly with hardcoding "alexa" as the wake up word. Meaning a specialized program monitors for "alexa" and ignores everything else and does not record.

Smart TVs might work similar, but I surely won't have anything like it in my home anyway.

That would be reassuring if there was literally any way to verify this.

Partly yes, but the microphone is still on, you have no access to the code so how can you determine that a malicious actor isn't listening in?

You won't know that with any other microphone either. Also any loud speaker to be precise (they can be used as microphones).

But like I said, I don't want to have those devices either and my smartphone has a removable battery ..

> How would you activate certain voice commands if it wasn't listening to all?

One common implementation is to use a locally detected wake word (described in another post), but I've also seen many which require you to hold down a button to speak voice commands. Both solutions answer your technical question satisfactorily.

However, this is how I (and most people) expect voice commands will work based on plain reading of the fine print: the voice commands will be transmitted, but it won't establish 24/7 audio surveillance of your house.

The fine print (and therefore the "explicit" "consent" so obtained) is deceptive and fraudulent.

---

However your real concern is apparently a trust question, not a technical question. That technical question was apparently just a distraction.

Obviously if you don't trust the implementer not to lie about their implementation (ie you assume fraud at the outset), then any microphone (or speaker for that matter!) could be a 24/7 listening bug regardless of trigger implementation or EULA fine print. I see that in another reply you already moved the goalposts thusly.[1] :P

[1] https://news.ycombinator.com/item?id=41424684

Whew. And I thought the mobile phone industry was a cesspit...

If traffic is encrypted, and there is constant other traffic to same server, then it might be hard to identify.

If you have speech synthesis running locally and send some keywords you can hide the data in the normal packets.

I was under the impression that was still infeasible on mobile devices (battery, processor, etc). Happy to be corrected, because I have to admit it's only a matter of time.

It’s not about mobile devices, but smart tvs and cable boxes.

So the "Hey siri"/"alexa"/"Ok Google", those features don't show your mic is recording, i dont think. Whether it's TVs or phones. all of the speech recognition and hands free control features are probably enough. there are masses of consumers that opt-in to these companies collecting data "to improve services" and other sketchy stuff. Honestly, I would think if you wanted to build a business around this it would be much better to go after the data collected behind EULAs that never got read than try to collect data from people who have all that shit turned off..