Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon to hand over Echo audio from alleged murder after defendant consents

bbc.com

Post reply on HN
Print view View original

151–160 of 196 posts

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#151

Post by andrepd »

idanoeman wrote: post #148
throwaway2016a wrote: post #134

Earlier quoted context omitted.

I hear this all the time and it boils down to what another poster said. I can monitor all the traffic going through my network. If the device was constantly streaming audio it would be very obvious. To which someone once replied to me: "But what if they aren't sending traffic through your network? What if they are using 4G or something like that?" To which I replied that while I have not personally done it. You could…

How do you know they don't 1. Listen all the time 2. Use a small neural network on the device to detect when a voice is present 3. Collect this data into one zip file, then send the file when the user says "Alexa", or anything remotely close. They could even put a size limit on the data upload to reduce the variance to prevent you from ever testing whether they do this. Or, they could simply transcribe the audio on t…

Yes, exactly this. They could easily just TTS what you are saying, save the text, and send it together with the rest of the info when you say "Alexa". Thus only sending information when you say "Alexa" but managing to upload all your conversations.

I would be very surprised if they aren't doing something like this. The power of analysing which products you talk about in your home more often, what kind of stuff you consume, what affairs do you discuss at home, etc, is too good to pass up. And seriously frightening.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#152

Post by Karunamon »

dandelion_lover wrote: post #146
Karunamon wrote: post #145

Earlier quoted context omitted.

Given that there's no proof that Amazon is doing anything untoward with the Echo right now, arguments along the lines of "but they might in the future!" are an instance of the fallacious version. If for no other reason, the behavior would be blatantly obvious to the kind of people that run Wireshark for funsies, the alarm would go up, and Amazon's reputation goes into the toilet.

Would you also say it about the NSA before the Snowden leaks? Given our current knowledge about the state of surveillance, we have enough reasons to believe in the worse. Upd: > the behavior would be blatantly obvious to the kind of people that run Wireshark for funsies Echo probably does not send the recordings all the time, it would be too simple to detect. However, it could simply send random parts of the recordin…

Echo probably does not send the recordings other than the ones it's expected and advertised to send. No proof of any kind exists to even begin to suggest it does something other than that.

The device itself has been rooted via a set of contacts compatible with what you'd use with a Raspberry Pi: https://www.reddit.com/r/netsec/comments/4inesj/rooting_the_...

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#153

Post by cperciva »

leeoniya wrote: post #149
icebraining wrote: post #28

Earlier quoted context omitted.

Or as cperciva put it, "Playing chicken with cat.jpg" http://www.daemonology.net/blog/2012-01-19-playing-chicken-w...

> In Tarsnap I might take this to an extreme — in addition to the aforementioned encryption, I encourage users to read the tarsnap source code rather than trusting that I got everything right You still have to trust that what's running on your machine and on the servers is compiled directly from the source you have access to, right?

You don't need to trust the code on the server -- that's the point.

You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#154

Post by dandelion_lover »

Karunamon wrote: post #152
dandelion_lover wrote: post #146

Earlier quoted context omitted.

Would you also say it about the NSA before the Snowden leaks? Given our current knowledge about the state of surveillance, we have enough reasons to believe in the worse. Upd: > the behavior would be blatantly obvious to the kind of people that run Wireshark for funsies Echo probably does not send the recordings all the time, it would be too simple to detect. However, it could simply send random parts of the recordin…

Echo probably does not send the recordings other than the ones it's expected and advertised to send. No proof of any kind exists to even begin to suggest it does something other than that. The device itself has been rooted via a set of contacts compatible with what you'd use with a Raspberry Pi: https://www.reddit.com/r/netsec/comments/4inesj/rooting_the_...

>other than the ones it's expected and advertised to send

and the ones that it mistakenly accepted as triggers, at least.

>No proof of any kind exists to even begin to suggest it does something other than that.

No proof exists to suggest anything about Echo. It is a question of trust. This is why I mentioned trust in my previous response.

Anyway, thanks for an interesting link.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#155

Post by M_Grey »

sesutton wrote: post #22
koolba wrote: post #3

This should be a lesson to people who don't understand the distinction between "can't" and "won't". If you're running things yourself and control the encryption keys required to access your data, then your service provider can't be compelled to release your data as it's not possible[1][2]. If you're delegating all of that to your service provider and they have access to the raw data, then you are putting all your tru…

>If you're running things yourself and control the encryption keys required to access your data, then your service provider can't be compelled to release your data as it's not possible The court can just hold you in contempt until you do[1]. They also probably won't buy "I forgot". [1]: https://arstechnica.com/tech-policy/2016/04/child-porn-suspe...

Leave the thing on a timed kill switch requiring secure input to reset the timer. It acts like a warrant canary, because the default is that without acting to intercede, your data is physically destroyed. That said... unless you have something really critical you must hide, potentially at the expense of whatever an angry/frustrated state might do to you... don't do it.

If you have an incredibly valuable idea, if you're protecting state secrets, if you're a journalist with real integrity, or a criminal who stands to lose more through exposure... then it makes sense. Otherwise, just for kicks, I don't see the point.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#156

Post by leeoniya »

cperciva wrote: post #153
leeoniya wrote: post #149

Earlier quoted context omitted.

> In Tarsnap I might take this to an extreme — in addition to the aforementioned encryption, I encourage users to read the tarsnap source code rather than trusting that I got everything right You still have to trust that what's running on your machine and on the servers is compiled directly from the source you have access to, right?

You don't need to trust the code on the server -- that's the point. You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.

ah yes, sorry.

is there a trusted compilation service that uses a distributed agreement mechanism, à la blockchain or DHT for validating some git/svn hash against a binary.

every downloadable source publishes its own binary hashes but the whole practice is somewhat moot in the event of server compromise, not to mention build reproducability.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#157

Post by ghshephard »

koolba wrote: post #39
ghshephard wrote: post #31

Earlier quoted context omitted.

You might put yourself in a worse position if the court compels you to produce the data, but now you can't. You better be very certain that you are able to prove that you deleted the data prior to any notice, or you might find yourself in for a long jail stay. This is what a lot of people overlook - when the court compels you to produce evidence, or ill gotten gains, saying ,"I can't" - isn't a legal defense.

> This is what a lot of people overlook - when the court compels you to produce evidence, or ill gotten gains, saying ,"I can't" - isn't a legal defense. We're getting closer and closer to testing that. IANAL but I'd imagine that some combination of the 4th and 5th amendments should cover that situation. The onus would be upon the prosecutor to prove that you destroyed the evidence after the fact. As a general rule,…

There's lots of case history where people are faced with a court order compelling them to return ill-gotten gains, and when they claim "I can't do it, I don't have the money." - they are found guilty of contempt of court if the court believes otherwise. Burden of evidence is not on the court to prove you do have the money, just as in this case, the burden wouldn't be on them to prove you can retrieve the data....

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#158

Post by graphememes »

skocznymroczny wrote: post #51
kaino128 wrote: post #11

Can you call emergency services via Amazon Echo? I've read on a car forum I'm part of about someone who was working on their vehicle without jack stands and got trapped when their jack slipped. They used Siri to call their wife and jack the car back up. They probably would have died without it. I can easily forsee a future where consumers ask companies for voice assistants that turn on automatically when they detect…

For all you know, it could be recording all the time, and since it's a closed device, you can't prove otherwise.

Actually you can monitor the packets coming through your network and prove whether it is recording or not.

Also reverse-engineering the Alexa, and taking it apart will allow you to see whether there is enough storage space for lengthy conversations. Which are only stored for in-transit post the wake-word however.

You can delete your recordings on amazon.com and google also allows you to delete your recordings if you use google home. So this will give you insight into what recordings they do have.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#159

Post by williamscales »

cperciva wrote: post #153
leeoniya wrote: post #149

Earlier quoted context omitted.

> In Tarsnap I might take this to an extreme — in addition to the aforementioned encryption, I encourage users to read the tarsnap source code rather than trusting that I got everything right You still have to trust that what's running on your machine and on the servers is compiled directly from the source you have access to, right?

You don't need to trust the code on the server -- that's the point. You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.

Do you trust your compiler?

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#160

Post by koolba »

cperciva wrote: post #153
leeoniya wrote: post #149

Earlier quoted context omitted.

> In Tarsnap I might take this to an extreme — in addition to the aforementioned encryption, I encourage users to read the tarsnap source code rather than trusting that I got everything right You still have to trust that what's running on your machine and on the servers is compiled directly from the source you have access to, right?

You don't need to trust the code on the server -- that's the point. You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.

Hey you guys provide binaries now? News to me!

Was never an issue till now though.

Post reply on HN