Live data from Hacker News

Ask HN: Is anyone monitoring popular apps to check if they're listening?

news.ycombinator.com

41–50 of 101 posts

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#41
post #9

If they are not actually listening, has someone mapped out how I get an ad related to a verbal conversation? What did they do to put the pieces together? I would imagine several different scenarios to get an actual match - but Ive wondered this at least a couple of times (too close a coincidence that is).

[deleted]

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#42

Earlier quoted context omitted.

"Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth" It was my understanding that typically phone voice audio quality is a few kilo bits per second - not much more than a kilobyte per second. This would get positively lost in the noise of modern smartphone constant background connectivity, no? (largely agree with your other points, though my understanding of original…

> This would get positively lost in the noise of modern smartphone constant background connectivity, no? If you’re only looking at total up/down traffic for the entire device, it might. But we can inspect traffic per-app, including decoding the actual traffic (if you go through steps to circumvent certificate pinning). Security researchers can, and do, look at the actual raw data coming out of apps. If voice was in t…

Any insight into how this was uncovered? A sports league secretly used their Android app's microphone to uncover illegal broadcasts.

https://www.techrepublic.com/article/laliga-facing-eur250k-f...

Edit: I was wrong, they were upfront with people about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-...)

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#43

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

You have started with a conclusion and filled in the blanks with your personal opinions.

And you have not actually answered the question. Which is, "have you actually VERIFIED that popular apps are not recording your conversations?"

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#44

Earlier quoted context omitted.

> This would get positively lost in the noise of modern smartphone constant background connectivity, no? If you’re only looking at total up/down traffic for the entire device, it might. But we can inspect traffic per-app, including decoding the actual traffic (if you go through steps to circumvent certificate pinning). Security researchers can, and do, look at the actual raw data coming out of apps. If voice was in t…

Any insight into how this was uncovered? A sports league secretly used their Android app's microphone to uncover illegal broadcasts. https://www.techrepublic.com/article/laliga-facing-eur250k-f... Edit: I was wrong, they were upfront with people about the purpose of recording ( https://www.techrepublic.com/article/how-one-spanish-soccer-... )

there wasn't anything to "discover", the app literally was telling users that was what it was doing.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#45
post #44

Earlier quoted context omitted.

Any insight into how this was uncovered? A sports league secretly used their Android app's microphone to uncover illegal broadcasts. https://www.techrepublic.com/article/laliga-facing-eur250k-f... Edit: I was wrong, they were upfront with people about the purpose of recording ( https://www.techrepublic.com/article/how-one-spanish-soccer-... )

there wasn't anything to "discover", the app literally was telling users that was what it was doing.

edit: I was wrong, they were pretty up front with users about the purpose of recording (https://www.techrepublic.com/article/how-one-spanish-soccer-...)

From the article: "Despite this, users were not explicitly informed of the intended use of the microphone and geolocation permissions, which is central to the decision by AEPD to levy fines against LaLiga."

Sounds like they were spying while using microphone permissions, which is what the discussion is about.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#47

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

>Recording and interpreting speech would require a lot of CPU (if done on device)

Does this include the newer Apple Axx series units with increasing number of ML cores? Siri is supposed to run locally on device. Hardware is moving explicitly in this direction. If this is done locally, no actual voice data would need to be sent down the wire. Insstead, a small compressed bit of text on keywords could be sent whether that's immediately or saved up until user foregrounds the app. No tinfoil hat needed to see how your premise is pretty weak.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#48
post #35

Earlier quoted context omitted.

Don't Android phones have passive listening? Pixel phones have always-on song detection (Shazam-like) and usually display song info on the lockscreen within ~10 seconds of the song being played nearby.

That works somewhat similarly to the "Ok Google". Dedicated chip and super small on-device ML model. Nothing goes back to the cloud.

> Nothing goes back to the cloud

What is your source on this? Every recognizable song is surely not stored on-device so something must be uploaded.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#49

Earlier quoted context omitted.

> This would get positively lost in the noise of modern smartphone constant background connectivity, no? If you’re only looking at total up/down traffic for the entire device, it might. But we can inspect traffic per-app, including decoding the actual traffic (if you go through steps to circumvent certificate pinning). Security researchers can, and do, look at the actual raw data coming out of apps. If voice was in t…

Any insight into how this was uncovered? A sports league secretly used their Android app's microphone to uncover illegal broadcasts. https://www.techrepublic.com/article/laliga-facing-eur250k-f... Edit: I was wrong, they were upfront with people about the purpose of recording ( https://www.techrepublic.com/article/how-one-spanish-soccer-... )

Fourth paragraph of the article explains it:

> This functionality is not happening surreptitiously, as the app requests access to the microphone and geolocation service—it does not rely on a vulnerability to access these components without explicit permission

Users had to have the app open and grant the permission. They weren’t recording secretly in the background.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#50

Earlier quoted context omitted.

"Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth" It was my understanding that typically phone voice audio quality is a few kilo bits per second - not much more than a kilobyte per second. This would get positively lost in the noise of modern smartphone constant background connectivity, no? (largely agree with your other points, though my understanding of original…

> This would get positively lost in the noise of modern smartphone constant background connectivity, no? If you’re only looking at total up/down traffic for the entire device, it might. But we can inspect traffic per-app, including decoding the actual traffic (if you go through steps to circumvent certificate pinning). Security researchers can, and do, look at the actual raw data coming out of apps. If voice was in t…

Average person speaks 16k words per day. Android considers app background traffic excessive at 50MB / hour, which is 1GB / day. 10% of that rate to steer clear of raising red flags is 100MB / day, about 10kB for each word you speak. Rather trivial to steganograph a word in 10kB of background traffic.

https://www.scientificamerican.com/article/women-talk-more-t...

https://developer.android.com/topic/performance/vitals/bg-ne...

Post reply on HN