Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is anyone monitoring popular apps to check if they're listening?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 101 posts

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#61

Post by ignoramous »

PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

The advertisements I see online or in email spam happen to coincide with whatever I had just been discussing with my mates. This has been the case for a good part of three years. May be its the Baader–Meinhof phenomenon as someone else in this thread points out, but the ads I see, at the time I see, make me quite uneasy knowing what I know being in tech.

Edward Snowden, famously, rids of the entire microphone-array from his phones and only uses external mics: https://youtu.be/ucRWyGKBVzo?t=888

See also: https://news.ycombinator.com/item?id=27932952 (Snowden on Privacy and Democracy)

https://twitter.com/snowden/status/1175422816403038208 (Snowden on smartphones)

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#62

Post by MrDunham »

giansegato wrote: post #26
PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

It's not only a matter of "big numbers", but also of confirmation bias. We're never paying any attention to irrelevant ads - we're ad blind to them. But the moment we see a very relevant ad to a recent conversation, that will inevitably pop up. "See, this one ad is tied to this conversation I had yesterday: they must be listening", while in reality it's more like "See, this one ad out of 100s I've seen in the last da…

This is correct. We even have a brain circuit for this: the reticulating activating system.

It's the reason I hadn't seen a Volvo for over 10 years until I mentioned that fact, then saw three that day.

So to your point, the RAS filters out/ignores 99 ads but will bring to your attention the one that is similar to something you've mentioned recently.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#64

Post by kurthr »

PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

I agree that the platforms don't currently allow them default access to microphones, but that's not how it used to be. I also agree that we would have likely heard about this (old) capability, due to the number of people who would have worked on it (unless they were supported by a TLA).

However, your description of what it would need to work is woefully naïve. There were startup funded apps that matched entire recorded song libraries to ambient sound (along with location) in the age of flip phones to track copyright violations in clubs. They relied on matching compressed periodogram hashes with an error tolerant database. The databases were large, but not unwieldy, and the computational load reasonable in the early 2000s. The ability to craft a database to a person to match a large set of commercial words/names with very low bandwidth is not impossible. Machine learning has made it easier.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#65

Post by joestrong »

stonewareslord wrote: post #48
vitno wrote: post #35

Earlier quoted context omitted.

That works somewhat similarly to the "Ok Google". Dedicated chip and super small on-device ML model. Nothing goes back to the cloud.

> Nothing goes back to the cloud What is your source on this? Every recognizable song is surely not stored on-device so something must be uploaded.

I've tried putting my phone in airplane mode and the feature still works. You can easily try that yourself.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#66

Post by dylan604 »

PragmaticPulp wrote: post #59
dylan604 wrote: post #47

Earlier quoted context omitted.

>Recording and interpreting speech would require a lot of CPU (if done on device) Does this include the newer Apple Axx series units with increasing number of ML cores? Siri is supposed to run locally on device. Hardware is moving explicitly in this direction. If this is done locally, no actual voice data would need to be sent down the wire. Insstead, a small compressed bit of text on keywords could be sent whether t…

> Insstead, a small compressed bit of text on keywords could be sent whether that's immediately or saved up until user foregrounds the app. Which would then appear in the packet captures that can be performed on the traffic (after circumventing certificate pinning). My premise wasn’t that each step was impossible. It was that many steps would have to take place without being detected anywhere along the chain.

How do you distinguish the, assumed, encrypted transmission from a foreground app sending this data compared to just requesting an update for the app's viewport?

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#67

Post by WA »

PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

So, does Instagram upload meta data such as GPS infos of your entire photo library if you give it access?

- there is no OS indicator

- it doesn’t require CPU time

- it doesn’t require much bandwidth

- it could happen only occasionally and could’ve slipped (automated) third party security screening

I don’t know if they do it. But I assume they can and might have done this. Hence, no access to my photo library.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#68

Post by angelzen »

kempbellt wrote: post #58
angelzen wrote: post #39

Earlier quoted context omitted.

The hardware runs an algorithm to detect the wakeword. What makes you confident that a different algorithm can't be run to translate voice to text? They will be in the same family of algorithms, just with different purposes. To make it more interesting, let's assume that 2021 algorithms can't do that. Will better low power algorithms be developed in the next 20 years? How is a democratic society supposed to work when…

When you train your phone to understand "Hey Siri" it requires an internet connection for the training so that it can verify that you are actually saying, "Hey Siri" and not "Yo, phone spirit". After the initial training, it no longer requires (or uses) the internet to detect the keyphrase. You are asked to do a few iterations of training so that the phone has a model on your voiceprint for "Hey Siri". Which is why,…

Good explanation, thanks. The scenario is 'translate on device, steganograph the output on background traffic'. There is a huge push for 'on device ML', driven by noble intentions of hiding raw data from Skynet. Alas, the end of that road is devices that compress the raw sensorial input and report, possibly stealthily, the digest to Skynet.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#69

Post by Terretta »

ignoramous wrote: post #61
PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

The advertisements I see online or in email spam happen to coincide with whatever I had just been discussing with my mates. This has been the case for a good part of three years. May be its the Baader–Meinhof phenomenon as someone else in this thread points out, but the ads I see, at the time I see, make me quite uneasy knowing what I know being in tech. Edward Snowden, famously, rids of the entire microphone-array f…

The simplest explanation of this is that there’s an antecedent reason you’re discussing what you’re discussing, and that’s the reason that correlates to the ads you see, rather than your discussion itself.

Perhaps it’s content you read. Perhaps it’s another product you researched. Perhaps it’s something someone in your office or home looked for from the same IP. Perhaps another ad campaign triggered the discussion. Then you talk about it. Then you see an ad related to the original trigger, and you notice it (the Baader Meinhof bit).

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#70

Post by SahAssar »

WA wrote: post #67
PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

So, does Instagram upload meta data such as GPS infos of your entire photo library if you give it access? - there is no OS indicator - it doesn’t require CPU time - it doesn’t require much bandwidth - it could happen only occasionally and could’ve slipped (automated) third party security screening I don’t know if they do it. But I assume they can and might have done this. Hence, no access to my photo library.

It's reasonable to assume that any photo sharing app checks EXIF data (and uploads it), including geotags. For some people this is something they want, as some people want the app to be able to show that info or be able to search their library by date/location.

If the app does not explicitly say it does not, I'd assume it does. I don't know if facebook/instagram has said if they do or don't.

Post reply on HN