Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is anyone monitoring popular apps to check if they're listening?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 101 posts

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#51

Post by detaro »

reginold wrote: post #45
detaro wrote: post #44

Earlier quoted context omitted.

there wasn't anything to "discover", the app literally was telling users that was what it was doing.

edit: I was wrong, they were pretty up front with users about the purpose of recording ( https://www.techrepublic.com/article/how-one-spanish-soccer-... ) From the article: "Despite this, users were not explicitly informed of the intended use of the microphone and geolocation permissions, which is central to the decision by AEPD to levy fines against LaLiga." Sounds like they were spying while using microphone permis…

And they prompted people to opt-in (with somewhat leading language) into this system to search for unauthorized playback. So there was no need to "discover" that the app did that, because the app literally said it had a system to do so. There is a range between "secretly" (= would need research attention to discover it happens) and "done correctly legally".

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#52

Post by casperc »

edent wrote: post #27
donclark wrote: post #9

If they are not actually listening, has someone mapped out how I get an ad related to a verbal conversation? What did they do to put the pieces together? I would imagine several different scenarios to get an actual match - but Ive wondered this at least a couple of times (too close a coincidence that is).

It's a mixture of things. The first is "Baader–Meinhof phenomenon" / frequency bias. Your friends talk about X, all of a sudden you notice adverts about X. Of course, you discount the thousands of adverts you see which aren't about X. Why are you and your friends talking about X? Because it's a demographically popular topic. And advertisers have noticed that $gender people of $age_range in $city are searching for X.…

Can all apps access information on the wifi hotspot that a user is connnected to? Seems like an information leak that should be closed by Apple/Google.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#53

Post by jatins »

max_ wrote: post #43
PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

You have started with a conclusion and filled in the blanks with your personal opinions. And you have not actually answered the question. Which is, "have you actually VERIFIED that popular apps are not recording your conversations?"

Depends on what level do you trust. For me, I'd generally trust OS indicators. So, if iOS doesn't show me a mic on indicator when Facebook is not open I'll consider thar verification.

A potentially better option would be if some independent non profit security firm audited major apps every once in a while, monitoring network traffic and such.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#54

Post by reginold »

PragmaticPulp wrote: post #49
reginold wrote: post #42

Earlier quoted context omitted.

Any insight into how this was uncovered? A sports league secretly used their Android app's microphone to uncover illegal broadcasts. https://www.techrepublic.com/article/laliga-facing-eur250k-f... Edit: I was wrong, they were upfront with people about the purpose of recording ( https://www.techrepublic.com/article/how-one-spanish-soccer-... )

Fourth paragraph of the article explains it: > This functionality is not happening surreptitiously, as the app requests access to the microphone and geolocation service—it does not rely on a vulnerability to access these components without explicit permission Users had to have the app open and grant the permission. They weren’t recording secretly in the background.

edit: ah yes, I was wrong here, they were disclosing

Here's a better article on this: https://www.techrepublic.com/article/how-one-spanish-soccer-...

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#55

Post by polote »

max_ wrote: post #43
PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

You have started with a conclusion and filled in the blanks with your personal opinions. And you have not actually answered the question. Which is, "have you actually VERIFIED that popular apps are not recording your conversations?"

"If there was an API for uploading your secret conversations, it would be the holy grail discovery for a security researcher. Someone would have found it."

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#56

Post by vadfa »

stonewareslord wrote: post #48
vitno wrote: post #35

Earlier quoted context omitted.

That works somewhat similarly to the "Ok Google". Dedicated chip and super small on-device ML model. Nothing goes back to the cloud.

> Nothing goes back to the cloud What is your source on this? Every recognizable song is surely not stored on-device so something must be uploaded.

It is actually stored in the device. A new database is downloaded from time to time

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#57

Post by dylan604 »

justusthane wrote: post #17
_wldu wrote: post #13

How do Android and iOS known when you say "OK Google" or "Hey Siri" if they are not listening all the time? Or, is it accepted that they are?

The listening for the initial keyword (e.g. “Hey Siri”) is done on hardware designed specifically for that purpose. That’s why you can’t change the keyword to whatever you want. Only when that keyword is heard does it actively listen to and process whatever follows. “Actively” listening all the time would simply consume too much CPU/bandwidth/battery.

>That’s why you can’t change the keyword to whatever you want.

Which I feel is a huge security oversight. You should be able to choose from a list of activation keywords at least. I love being on video/voice chats with people that I know have a device and randomly say "Alexa, play Dancing Queen" or something equally obnoxious like "Alexa, turn off lights".

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#58

Post by kempbellt »

angelzen wrote: post #39
midasuni wrote: post #30

Earlier quoted context omitted.

Power consumption

The hardware runs an algorithm to detect the wakeword. What makes you confident that a different algorithm can't be run to translate voice to text? They will be in the same family of algorithms, just with different purposes. To make it more interesting, let's assume that 2021 algorithms can't do that. Will better low power algorithms be developed in the next 20 years? How is a democratic society supposed to work when…

When you train your phone to understand "Hey Siri" it requires an internet connection for the training so that it can verify that you are actually saying, "Hey Siri" and not "Yo, phone spirit". After the initial training, it no longer requires (or uses) the internet to detect the keyphrase.

You are asked to do a few iterations of training so that the phone has a model on your voiceprint for "Hey Siri". Which is why, when someone who does not have a similar voice to you says "Hey Siri" it does not trigger. But someone who does have a similar voice to you can sometimes trigger it. The model is super basic.

The microphone is always passively passing input data to the "Hey Siri" detector (and a buffer), which acts as a sort of internal switch. If it detects the trigger phrase, it then sends the audio data to the cloud to be transcribed, and acted upon accordingly.

It is not always sending voice data to the cloud. If it were, your battery life would be noticeably impacted - worse than being on a phone call.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#59

Post by PragmaticPulp »

dylan604 wrote: post #47
PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

>Recording and interpreting speech would require a lot of CPU (if done on device) Does this include the newer Apple Axx series units with increasing number of ML cores? Siri is supposed to run locally on device. Hardware is moving explicitly in this direction. If this is done locally, no actual voice data would need to be sent down the wire. Insstead, a small compressed bit of text on keywords could be sent whether t…

> Insstead, a small compressed bit of text on keywords could be sent whether that's immediately or saved up until user foregrounds the app.

Which would then appear in the packet captures that can be performed on the traffic (after circumventing certificate pinning).

My premise wasn’t that each step was impossible. It was that many steps would have to take place without being detected anywhere along the chain.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#60

Post by reginold »

detaro wrote: post #51
reginold wrote: post #45

Earlier quoted context omitted.

edit: I was wrong, they were pretty up front with users about the purpose of recording ( https://www.techrepublic.com/article/how-one-spanish-soccer-... ) From the article: "Despite this, users were not explicitly informed of the intended use of the microphone and geolocation permissions, which is central to the decision by AEPD to levy fines against LaLiga." Sounds like they were spying while using microphone permis…

And they prompted people to opt-in (with somewhat leading language) into this system to search for unauthorized playback. So there was no need to "discover" that the app did that, because the app literally said it had a system to do so. There is a range between "secretly" (= would need research attention to discover it happens) and "done correctly legally".

Thanks for this! Found another article where this is better explained: https://www.techrepublic.com/article/how-one-spanish-soccer-...
Post reply on HN