Bose Headphones Spy on Users, Lawsuit Says • Hacker News Board

Re: Bose Headphones Spy on Users, Lawsuit Says

#171

Post by [deleted] » Wed, Apr 19, 2017, 9:02 PM UTC

HenryBemis wrote: post #115

theseatoms wrote: post #107

Is anyone compiling a black-list of companies that implicitly charge users by quietly (or not-so-quietly) collecting their data? This is increasingly becoming the consumer protection issue of our time. A white-list of companies that do NOT do this could also be useful, especially as alternatives to companies on the black-list.

I think that for ANYTHING that requires an app and connection to the internet, we all should take for granted that: 1) data is being collected (e.g. my precious steps/vitals/food intake on fitbit) 2) data is being transmitted to "mother ship" and then sold to everyone that is willing to buy (e.g. why on earth did iOS fitbit app wanted to connect to facebook??? and then I stopped using fitbit - of course I was using a…

[deleted]

Re: Bose Headphones Spy on Users, Lawsuit Says

#172

Post by ecomhacker » Wed, Apr 19, 2017, 9:02 PM UTC

mikestew wrote: post #85

ecomhacker wrote: post #45

Earlier quoted context omitted.

This reminds me of a bluetooth toothbrush I just bought that requires my location to be enabled to change the settings via the oral b app which is required since this model has less buttons than others. The reason why I bought a bluetooth toothbrush was for a wireless hardware clock, brushing timer, and ranking system which also really doesn't work correctly even with the app.

The reason why I bought a bluetooth toothbrush... Phone apps...for a goddamn toothbrush. Were someone to ask me, "Mike, you do a lot of Bluetooth work, what if we BT-enabled our electric toothbrush...what kind of value could we add with that?" Because I'm horrible at coming up with creative ideas for new technologies, I'd come up with something lame like, say, maybe a "ranking system". I could add a "brushing timer",…

Sorry for the late reply. I was hacking on some code.

I got the toothbrush because I am depressed/a drug addict and usually don't brush my teeth as often as I should. I was using a tracking app, but I figured since it was bluetooth I might be able to integrate it with the app I'm using for tracking. I figured it wouldn't support this out of the box, but I'm a CS/EE and figured if I was bored, it would be one more toy to play with.

TLDR, I've got money to burn and I'm spending it to avoid personal responsibility

Re: Bose Headphones Spy on Users, Lawsuit Says

#173

Post by tomtalks » Wed, Apr 19, 2017, 9:07 PM UTC

justabystander wrote: post #164

tomtalks wrote: post #140

(Created an account to post this) I downloaded the app on android and listened to a few songs on Spotify to find out what information was being sent. While the app is running, the app sends a HTTP (edit: HTTPS) request every time the track information changes or the volume changes. When the track information changes it sends the artist, album and song name. When you change the volume it sends the new volume level. Ev…

Questions this brings up: 1. What's the estimated bandwidth impact of this data collection? Many users have very limited data use, and chatty messages on play/pause/volume change wouldn't be appreciated. 2. HTTP or HTTPS? 3. How does it work with other apps (like Google Music) that might provide more music details? Like does it send more information when the id3 tags have all the fields filled in? Things like comment…

1. From the data I collected, the content of each message of is roughly 1000-2000 bytes. This is not much on it's own but over the course of a day it could end up. It appears as messages are queued and send in bulk when applicable, therefore I can't comment on bandwidth over time as the app may chunk its request. It may not even send messages when the screen is closed.

2. Everything is secured with HTTPS! All the analytics messages, messages to boses servers and firmware checks are all over HTTPS (The firmware file its self is downloaded over HTTP, but the URL is provided over HTTPS and the firmware may well be signed)

3. A good question that needs further investigation :)

4. The anonymous id doesn't have any glaring information at least not immediately from the analytics platforms documentation https://segment.com/docs/spec/identify/ however yes the other meta-data defeat the purpose of an anonymous id.

5. It is definitely sending the data while the app is in focus, and i believe while the app is open but not in focus. I am not 100% sure here as it was a very quick test.

6. Again something else to investigate :)

Re: Bose Headphones Spy on Users, Lawsuit Says

#174

Post by kbenson » Wed, Apr 19, 2017, 9:07 PM UTC

jdmichal wrote: post #148

kbenson wrote: post #93

Earlier quoted context omitted.

> change the settings via the oral b app which is required since this model has less buttons than others. I find it disturbing that we're moving to an era where even simple devices require the equivalent of a sonic screwdriver to make work. I really, really wish we had a generic discovery, configuration and reporting protocol (like HTML forms but much more rigid and no styling) for configuring bluetooth devices that…

You mean like SNMP? https://en.wikipedia.org/wiki/Simple_Network_Management_Prot...

I mean something that hasn't been overcomplicated and extended to the point that it's impossible to assume simple standard behavior.

That is, SNMP might make a good underlying protocol that something that is much more constrained might sit on top of. Ideally, a simpler markup language that can compile down to SNMP.

E.g. a "device" has one or more named "config-forms" (which an app might choose to represent each as a separate tab or section), with a well defined set of settings with a name, type (integer, decimal, sized string) and description. A device might have one or more "reports" which provide a consolidated view of particular variables.

Very simplistic, but with simplicity comes interoperability. SNMP by itself is far too general to support this without some constraints put on top of it (as far as I know, at least. I have experience with SNMP, but not a huge amount, and not for a long time).

Re: Bose Headphones Spy on Users, Lawsuit Says

#175

Post by prisonerOfwar75 » Wed, Apr 19, 2017, 9:10 PM UTC

Not surprised - I just assume every company that has my data which explicitly says it does not sell your data does.

A side note:

One day I noticed the gps icon on my iphone was lighting up one evening even through non of the apps were using it. I opened up the app drawer to see which app was using it and it was Outlook. I immediately deleted the app and then I saw another app without gps permissions access it.. I got goosebumps immediately and powered off my phone. Without a doubt in my mind I believe there's built in remote access tracking software in IOS. I know I sound crazy and a bit paranoid but I can't explain it.

Re: Bose Headphones Spy on Users, Lawsuit Says

#176

Post by throwawaybose » Wed, Apr 19, 2017, 9:14 PM UTC

tomtalks wrote: post #140

(Created an account to post this) I downloaded the app on android and listened to a few songs on Spotify to find out what information was being sent. While the app is running, the app sends a HTTP (edit: HTTPS) request every time the track information changes or the volume changes. When the track information changes it sends the artist, album and song name. When you change the volume it sends the new volume level. Ev…

Oddly enough, my Bose Sound Link speaker requests a "sync contacts" bluetooth permission. Anyone know why?

http://m.imgur.com/JDiNdKz

Re: Bose Headphones Spy on Users, Lawsuit Says

#177

Post by jdmichal » Wed, Apr 19, 2017, 9:21 PM UTC

kbenson wrote: post #174

jdmichal wrote: post #148

Earlier quoted context omitted.

You mean like SNMP? https://en.wikipedia.org/wiki/Simple_Network_Management_Prot...

I mean something that hasn't been overcomplicated and extended to the point that it's impossible to assume simple standard behavior. That is, SNMP might make a good underlying protocol that something that is much more constrained might sit on top of. Ideally, a simpler markup language that can compile down to SNMP. E.g. a "device" has one or more named "config-forms" (which an app might choose to represent each as a…

Sure. I don't think SNMP is complete in any way for this solution... For instance, it communicates in OIDs, while a user interface would want names and data constraints at a minimum. But I also agree that it would make a good base to build on top of. I mostly just wanted to avoid the xkcd standards problem [0].

I'm pretty much in the same place on SNMP... Had to do some integration with it 10 years ago. Had to even do some Google-fu to remember the name, since the only thing that would come to mind was SMTP.

[0] https://xkcd.com/927/

Re: Bose Headphones Spy on Users, Lawsuit Says

#178

Post by jumpkickhit » Wed, Apr 19, 2017, 9:28 PM UTC

jumpkickhit wrote: post #159

tomtalks wrote: post #140

(Created an account to post this) I downloaded the app on android and listened to a few songs on Spotify to find out what information was being sent. While the app is running, the app sends a HTTP (edit: HTTPS) request every time the track information changes or the volume changes. When the track information changes it sends the artist, album and song name. When you change the volume it sends the new volume level. Ev…

Did you packet sniff what is being sent out? Or do you have some intermediary running on the device itself? Just curious if it was difficult to do. If more people knew how to, maybe this sort of activity wouldn't sneakily happen as often.

Wow, thanks for all the replies!

Re: Bose Headphones Spy on Users, Lawsuit Says

#179

Post by wbraun » Wed, Apr 19, 2017, 9:42 PM UTC

I own both the headphones and the speaker mentioned in the article and have the app installed. It's a sad reflection on the state of privacy, but my first reaction to reading the article was getting excited about possible class action $$. Data collection like this is so commonplace nowadays its hard to be surprised. Still disappointed in Bose though.

Re: Bose Headphones Spy on Users, Lawsuit Says

#180

Post by chadgeidel » Wed, Apr 19, 2017, 10:02 PM UTC

boomboomsubban wrote: post #118

theseatoms wrote: post #107

Is anyone compiling a black-list of companies that implicitly charge users by quietly (or not-so-quietly) collecting their data? This is increasingly becoming the consumer protection issue of our time. A white-list of companies that do NOT do this could also be useful, especially as alternatives to companies on the black-list.

If it has proprietary software and uses an internet connection, assume it is collecting your data.

"If it uses an internet connection, assume it is collecting your data." - FTFY.

Open source isn't a panacea when no one reads the code.