I'm honestly surprised they went that far, and happy they did.
I think accidental unmuting due to random events would translate into “theyare listening to me” in their average customer’s mind, and would be a pr disaster. Compare the cost of that to an extra component, and the surprise goes away.
There’s no “extra component” in the physical design. Both flip-flops are in the single 74x74 package and if you’re only using one, you have to drive the other to a known state anyway, so why not use them both anyway?
I have noted this with several high ranking posts on HN. I wonder whether it's a case of the author being unaware of BLUF, or simply that they want you to read their work before finding the conclusion?
I see it a lot at work and chalk it up to some people having learned/internalized a legalistic way of building up a pattern of facts and basing each on the previous. It’s not so much that they want you to read 2 pages but that they want you to believe every newly introduced bit of the story.
Here in Japan too, bottom-up is the standard pattern.
Japanese people can learn to use BLUF, but it's very much not the culturally expected approach.
Red light used to indicate recording, traditionally. I'd expect the light to be green when I'm safe from spying.
On conference room phones (polycom spiders and similar), red usually indicates muted.
From an end user mental model perspective, I think Echos are closer to that than to recording studio equipment. “Normally, to use this device, I speak to it and it warns me when that function is disabled.”
IIRC Apple hardwires camera LED to enable pin for some time now. You can't even disable the LED even if you tamper with the camera firmware. Old Logitech Pro 9000 is the exact opposite. You can control the LED independently of the camera state.
We have been over this before: if you want to take surreptitious images on Apple, you operate the camera at a low enough duty cycle that it doesn't look like it's on.
It could have been wired to indicate recording for a minimum of a second after each image capture. But it wasn't.
Yes that is the technical conclusion. But maybe the most important thing is that we have to do an actual teardown of the product in order to have some confidence that Amazon is not lying on it's Echo capabilities. To be clear, I am not saying we should trust Amazon & Co, I'm saying that if that's the level of trust we have with home assistance devices, why even bother with the stuff ?
We have options of either to trust the company or some other auditor. We can try getting some laws made to ensure honesty, but I personally don't like that route this early in the technology. What we need a completely independent organisation like EFF to audit and certify basic guarantees around privacy/safety. The companies should also prefer this route as it would give take some heat off in EU/Congress without crea…
That would make EFF a de facto certifier, taking on the role of state and make it a (bigger) target for big business. Really, we need laws (and a system that isn't broken. More like in Scandinavia, less like the Federal Communications Commission).
Disclosure: I'm an Amazon Devices PE, but not on Alexa devices. Jeff (and others) have spoken publicly about this in the past, and this teardown is correct. The hardware is designed such that, if the privacy LED is on, the microphone is unpowered. In order to compromise that, one would need to physically alter/damage the hardware.
AFAIK a reboot would trigger a reset from mic off to mic on. If true that is a very poor choice for a privacy switch.
I sometimes write articles describing investigations similar to this one. Do you think this article’s structure is appropriate? Or would it be better to reduce the need for comments like this one by putting the conclusion much earlier in the piece? I understand not putting the conclusion in the title, but perhaps in the first paragraph, in the spirit of BLUF [0]? [0] https://en.wikipedia.org/wiki/BLUF_(communication)
I think that BLUF is definitely the better way of writing most informational pieces, particularly articles such as this. It's a similar concept to the 'Topic Sentence' which would be used to sum up the ideas of the following paragraph. The only reason I could see for actively choosing not to use BLUF - would be to force users to read more of your article for the sake of it, which seems (to me) like a 'cheap' tactic.
Do you think presenting the conclusion up-front could detract from the “story-telling” of the piece? By walking the reader through the investigation and its findings in chronological order, perhaps the article aims to make the reader feel like they are performing the investigation themselves?
Disclosure: I'm an Amazon Devices PE, but not on Alexa devices. Jeff (and others) have spoken publicly about this in the past, and this teardown is correct. The hardware is designed such that, if the privacy LED is on, the microphone is unpowered. In order to compromise that, one would need to physically alter/damage the hardware.
AFAIK a reboot would trigger a reset from mic off to mic on. If true that is a very poor choice for a privacy switch.
Also a minor hardware re-design may change mic switch behaviour in the future without that change being noticeable to the buyer. You'd really need regular tear-downs of a sufficient sample-size of devices to make sure that you can actually trust newly bought devices with sufficiently high confidence.
Interesting read. But if I owned one, I would destroy the trace going to the mic, specifically the one giving power, and install my own physical switch as a physical power switch.
The fact that the mike defaults to on after power on is completely understandable from a user interface perspective, but from a security perspective it makes the mute switch useless. Why? Because any attacker that has penetrated far enough to be able to control the SOC in order to snoop can also trigger a SOC reset in order to make sure that the mike is enabled before they start snooping. A physical switch would have…
> The fact that the mike defaults to on after power on is completely understandable from a user interface perspective
A compromise would be to play a message after turning the device on, requiring user to take action and unmute it or leave muted. This shouldn't be a problem in most scenarios as Echo is meant to be powered once and run for a long time, so it would be just a minor inconvenience.