Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alexa and Siri Can Hear Hidden Commands

nytimes.com

Post reply on HN
Print view View original

41–50 of 178 posts

Re: Alexa and Siri Can Hear Hidden Commands

#41

Post by kalleboo »

exodust wrote: post #9

I hadn't thought of this, it's quite concerning. I don't see how they can safeguard against this without reducing the effectiveness of the voice recognition. A secret command to "paste clipboard into new email, send to [address]" is a shiny new attack vector without any apparent straight forward way to plug the security hole.

Siri is supposed to be tailored to your own voice and not accept commands from anyone else. Sounds like they need to approve that fingerprinting. (or this different on the HomePod since it's supposed to be used by multiple people?)

Re: Alexa and Siri Can Hear Hidden Commands

#44

Post by sailfast »

I can't recommend highly enough that everyone at least turn on the audible sound when their assistants are listening. At a minimum you should know the kinds of things that end up triggering the device. There's a really wide area of detection and it's interesting to see where that is.

I would also recommending changing your default word at a minimum. Then again, I might also recommend ditching the device entirely but I happen to have one in my kitchen that I like OK sometimes.

Re: Alexa and Siri Can Hear Hidden Commands

#45

Post by baxtr »

Jun8 wrote: post #6

The interesting thing is that Google Assistant has teh same problem, it's right there in the subtitle. It's interesting that it was omitted from the main title. Rather than journalistic oversight I think this verifies what people have commented many times: that the fact that GA does not have a personalized name makes it to refer to it. SO much so that a very distant third product is included rather than GA.

Maybe the main title would be too long if it included “and google’s voice assistant”

Re: Alexa and Siri Can Hear Hidden Commands

#46

Post by adambowles »

coleca wrote: post #29

Isn't there an inaudible tone that you can use to disable the assistant? I recall reading somewhere that Amazon used it in their commercials for Alexa so that everyone's Echos weren't lighting up during the commercials. I know when a commercial for the Echo comes on and the voices repeat "Alexa, do X" the Echo I have near the TV speaker doesn't light up.

If I recall correctly, the adverts omit a certain frequency range from the assistant's invocation phrase which human's won't notice is missing

Edit: Yep, omit / reduce tones in the 3000 - 6000 Hz range https://www.reddit.com/r/amazonecho/comments/5oer2u/i_may_ha...

Re: Alexa and Siri Can Hear Hidden Commands

#47

Post by hunter2_ »

rootusrootus wrote: post #37
hunter2_ wrote: post #19

Earlier quoted context omitted.

This doesn't address your question but might be interesting. As someone who has used Android forever and never tried Siri, those anecdotes are mind blowing to me. For me with Google Assistant, media commands work about 80% and successful call initiation is about 90%. And I haven't looked for documentation either. YMMV of course.

Sometimes it works great. Sometimes I can't get Siri to do anything right. Anecdotally I've found that Google's voice assistant is quite a lot better. Unfortunately I am unwilling to accept the rest of Google's terms and conditions so I am stuck with Siri for the foreseeable future.

I disagree with the terms of plenty of things that I use anyway, and I ain't dead yet. I do realize that it could jeopardize me in the future, but the convenience outweighs most of my cares. It's horrible, really. I imagine it's how smokers with no intention of quitting feel.

Re: Alexa and Siri Can Hear Hidden Commands

#48

Post by DecoPerson »

exodust wrote: post #15
djrogers wrote: post #10

Earlier quoted context omitted.

The obvious plug would be to not allow such a ridiculously unsafe command without requiring you to unlock your device, much like my iPhone does today.

Sure, but your phone is sometimes already unlocked because you used it 30 seconds ago and it now sits on the table. Or it's playing music, or your kid has it etc. I don't think I was thinking about a phone anyway, more the dedicated devices that sit there listening all the time.

So lock your phone every time you set it down. Never leave it unlocked.

I used to have my iPhone lock 5min after I pressed the sleep button. Now that TouchID makes it very easy to unlock, I have it locking immediately.

When I let my friend's 4yo use my iPad, I triple tap the home button and press "Guided Access", which can prevent the user from accessing other apps until I disable it. (I do this because I'm worried about what he may accidentally search on the web, not because I'm worried he'll steal my data!)

Re: Alexa and Siri Can Hear Hidden Commands

#49

Post by [deleted] »

Nelson69 wrote: post #17
newsbinator wrote: post #8

I can't get Siri to turn on the flashlight or lock my phone. What can Siri do that's dangerous?

Well, it can read your schedule, tell you your location and then there is the homekit stuff. It could potentially disable certain security features you might have installed at your house, it could possible perform a very expensive modification to your HVAC configuration, in an extreme case that could maybe be fatal (disable heating in the winter at an older person's home or something like that.) It can also read your…

[deleted]

Re: Alexa and Siri Can Hear Hidden Commands

#50

Post by Infernal »

newsbinator wrote: post #14
exodust wrote: post #12

Earlier quoted context omitted.

Send emails is one example. I don't use Siri, but apparently it can send emails including to multiple recipients. The "danger" is only limited by your imagination in the scenario where a malicious stranger has access to your email client.

I guess you could tell Siri, > Send an email to my mom that says, "I have an emergency and I need $2000. Here's the account number to send it to: 12345. Mom, please don't ask questions. This is urgent. Send the money now." Would Siri lookup your mom's email and send that?

If you have previously identified one of your contacts as your mother, yes. If not, Siri will ask who your mother is and if Siri should remember that piece of information.
Post reply on HN