Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon US customers given one week to opt out of mass wireless sharing

theguardian.com

Post reply on HN
Print view View original

231–240 of 338 posts

Re: Amazon US customers given one week to opt out of mass wireless sharing

#231

Post by secabeen »

kstrauser wrote: post #154
azinman2 wrote: post #135

Earlier quoted context omitted.

It seems to be. It can use up to 500mb/month of data, and is more than just for tracking something with tiny payloads of anonymized data. But it doesn’t seem to be sharing your internet like a lot of people seem to claim. I guess the fear is that there’s some security vulnerability that makes that more possible?

From their FAQ: https://www.amazon.com/Amazon-Sidewalk/b?ie=UTF8&node=213281... > When Sidewalk is on, your Bridge can share a low-bandwidth connection with Sidewalk-enabled devices, like sensors and smart lights that are installed in locations around and outside your home where wifi may not be available. Amazon Sidewalk does not support high-bandwidth connections like a wifi or cellular network would, so you would s…

Perhaps, but does the same thing not apply to Apple iOS or Google Android devices? If an attacker finds a vulnerability in one of these common devices, they can compromise any of your users' devices and can then open file shares, exfiltrate data over their cellular link, etc.

We are now in year 7 of availability of Amazon Echo devices, and there are two recorded vulnerabilities (one required internal hardware access, the other required connecting the device to a malicious WiFi AP.) Given that track record, there may never be a broadly exploitable vulnerability in the devices; they are pretty locked down and they auto-update regularly, with no provision for delaying or blocking said updates.

Re: Amazon US customers given one week to opt out of mass wireless sharing

#232

Post by secabeen »

ravenstine wrote: post #228
failwhaleshark wrote: post #222

Earlier quoted context omitted.

Where's the sanctimonious outrage at Skype, which is almost entirely p2p? Tile? BitTorrent? ipfs? i2p? Bitcoin? freenet? (LOL, jk) Or that software/firmware updates are automatic. Oooh! Also that Alexa is recording all the time without your permission. Insert moral panic here. In addition, 99% of IoT "smart" devices will cease operating whenever the company decides to turn off their servers. Where's the outrage and b…

Give me a break. Skype isn't using your bandwidth for other people's calls. With Tile, they make it pretty clear that you're joining a network of Bluetooth devices. As to why you're mentioning P2P protocols like BitTorrent, um... what exactly are you smoking? This has nothing to do with the retroactive opt-out sharing of bandwidth that Amazon is doing. People don't like it when they buy something and then it suddenly…

> Skype isn't using your bandwidth for other people's calls.

Skype used your bandwith for other people's calls for years and years. Look up the old settings on blocking your device from becoming a "supernode". Back in the day as university IT people, we had to set a registry key on all of our windows machines, or they would become the relay server for dozens of international Skype calls.

That feature is no longer part of Skype, but it very much was a thing.

Re: Amazon US customers given one week to opt out of mass wireless sharing

#233

Post by sidlls »

teknopaul wrote: post #151
philwelch wrote: post #139

Earlier quoted context omitted.

With all due respect, it’s a microphone connected to the internet that you are meant to install in your home. How are you surprised to see it used as a surveillance device?

no no no, you should not expect people to behave badly. I agree with the sentiment that it is a crying shame this technology could be used to help people for whom keyboards become complicated but instead it's used to trick them.

> you should not expect people to behave badly

I've never been disappointed expecting people to behave quite badly.

Re: Amazon US customers given one week to opt out of mass wireless sharing

#234

Post by kstrauser »

secabeen wrote: post #231
kstrauser wrote: post #154

Earlier quoted context omitted.

From their FAQ: https://www.amazon.com/Amazon-Sidewalk/b?ie=UTF8&node=213281... > When Sidewalk is on, your Bridge can share a low-bandwidth connection with Sidewalk-enabled devices, like sensors and smart lights that are installed in locations around and outside your home where wifi may not be available. Amazon Sidewalk does not support high-bandwidth connections like a wifi or cellular network would, so you would s…

Perhaps, but does the same thing not apply to Apple iOS or Google Android devices? If an attacker finds a vulnerability in one of these common devices, they can compromise any of your users' devices and can then open file shares, exfiltrate data over their cellular link, etc. We are now in year 7 of availability of Amazon Echo devices, and there are two recorded vulnerabilities (one required internal hardware access,…

No, it doesn't. Those aren't designed to make a bridge between untrusted networks. With a phone, they're usually on either LTE (which is generally regarded as reasonably secure) or your home network, but not typically both at the same time. Someone at Verizon could hypothetically exploit my phone from inside their network and then use that to attack my home LAN but that seems a pretty low risk.

I don't believe that any of my neighbors has worked as hard to secure their home network as my cell phone carrier has.

The number of prior vulnerabilities isn't relevant here. Up until now, an Alexa has been more or less a "dumb" client that relays voice samples to a cloud server for processing. Now it's being repurposed into a new role as a network server itself, running new software that hasn't yet been widely tested, which implements a new network protocol which hasn't been widely deployed.

Re: Amazon US customers given one week to opt out of mass wireless sharing

#235

Post by secabeen »

kstrauser wrote: post #55
hellisothers wrote: post #15

I’ve seen a couple other articles like this that that to “both sides” this by claiming Apple does it with AirTags. Seems pretty disingenuous, feels like comparing faxing documents to the internet…

I've seen this, too. Apple: Their device: "Hi, I'm an AirTag! This is my serial number!" Your device: "hey Apple, I was at (X, Y) when I saw this serial number." Amazon: Their device: "Hi, can I send traffic through your network?" Your device: "sure, buddy!" They're so fundamentally different that I pretty much assume a bad faith argument from people who say they're similar.

> Apple: Their device: "Hi, I'm an AirTag! This is my serial number!" Your device: "hey Apple, I was at (X, Y) when I saw this serial number."

> Amazon: Their device: "Hi, can I send traffic through your network?" Your device: "sure, buddy!"

I think you're mis-characterizing Amazon here. It's not "can I send traffic through your network", it's "can you pass this message to Amazon for me? Amazon will pass it on to my manufacturer." The devices in question can only talk to a specific set of Amazon servers. They can't talk to any systems other than the Sidewalk Servers.

Re: Amazon US customers given one week to opt out of mass wireless sharing

#236

Post by josho »

turdnagel wrote: post #110

I could see working on Sidewalk as kind of a dream if you have no morals. A mesh network you can turn on with a flip of a switch, with millions of devices across the world? Seems really cool, if you don't care about privacy or security. But if you do - and we should - it's a disaster.

On the flip side I would love it if everyones wifi routers had a second SSID that was open to the general public.

Why the hell aren’t we making it easy to share our home bandwidth with friends, family, and strangers needing a few mb of data?

If this makes that acceptable again then I’m all in.

Re: Amazon US customers given one week to opt out of mass wireless sharing

#237

Post by secabeen »

kstrauser wrote: post #234
secabeen wrote: post #231

Earlier quoted context omitted.

Perhaps, but does the same thing not apply to Apple iOS or Google Android devices? If an attacker finds a vulnerability in one of these common devices, they can compromise any of your users' devices and can then open file shares, exfiltrate data over their cellular link, etc. We are now in year 7 of availability of Amazon Echo devices, and there are two recorded vulnerabilities (one required internal hardware access,…

No, it doesn't. Those aren't designed to make a bridge between untrusted networks. With a phone, they're usually on either LTE (which is generally regarded as reasonably secure) or your home network, but not typically both at the same time. Someone at Verizon could hypothetically exploit my phone from inside their network and then use that to attack my home LAN but that seems a pretty low risk. I don't believe that a…

It's a change, certainly, but mobile devices are a much bigger risk to your internal network than a Echo device is. Both are general-purpose computers inside, but the attack surface of a phone is way larger, and there are plenty of recorded instances of phones being compromised. The Echo devices have a good security track record, and I feel they remain much less likely to be compromised than any mobile device.

The number of prior vulnerabilities is totally relevant. Your threat model required a vulnerability to be found in these devices allowing them to access your network maliciously. I am presenting data showing that the such a threat is unlikely, especially when compared to mobile devices that you (presumably) already grant unfettered access to your network.

Sure, if you feel that an Echo device is now a larger threat than it was before this feature was enabled, you may want to get rid of the device. I don't feel that way, I think the small increased threat to my network is outweighed by the value of being able to find my dad's keys when he drops them (and the attached Tile locator) outside the home of someone with an active Sidewalk device.

Re: Amazon US customers given one week to opt out of mass wireless sharing

#238

Post by YeBanKo »

luma wrote: post #134
beezischillin wrote: post #100

Earlier quoted context omitted.

The other major difference is that you directly benefit from Find My and you can also turn it off any time you want.

Playing devil's advocate here... aren't those same two things true of Sidewalk? If you purchase an Apple tag, then you benefit from other users who have this feature enabled. If you buy a device that uses Sidewalk, same situation. Both can be disabled.

You can’t opt out of Sidewalk after June 9. You can opt out of Apple’s Find My network any time you want on a per device basis.

Re: Amazon US customers given one week to opt out of mass wireless sharing

#239

Post by unyttigfjelltol »

remarkEon wrote: post #68

Article doesn't mention it, but this is how you opt-out (there are others but this one has screenshots). https://www.tomsguide.com/reference/what-is-amazon-sidewalk Added to my list for the next time I'm on the phone with my parents, for our (weekly at this point) how-to sessions on "stopping the industry I work in from spying on you". I really, really wish product managers would understand the kind of ecosystem they…

Missed a step in that opt-out how-to: 1. Install Alexa App on phone.

Why can't I disable this 'account setting' from the Amazon web portal. Plus, if I mistrust Amazon's repurposing of devices, why would I want an Alexa app installed to potentially repurpose my phone? Funnily enough, Sidewalk was just one of 3 surprising anti-security/anti-privacy settings available only in the app.

Re: Amazon US customers given one week to opt out of mass wireless sharing

#240

Post by geertj »

duped wrote: post #217
Spivak wrote: post #215

Earlier quoted context omitted.

Okay so every device comes with cellular radios which talk to the same IoT API. Does anything really change for you?

Yes, I'm not paying for your infrastructure. Isn't this what 5G is supposed to be used for?

The Sidewalk network has a very low bandwidth of 80kbps with a cap of 500 MB per month. I doubt that it will incur extra cost for most people. Is your concern about the principle of sharing bandwidth or are you worried about the actual cost?
Post reply on HN