Haven't checked but couldn't you make one that does and compare data usage volume?
But "listening, on everyone" and "all the time" are not necessary assumptions.
Ask HN: Is anyone monitoring popular apps to check if they're listening?
71–80 of 101 posts
Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?
#72Earlier quoted context omitted.
Don't Android phones have passive listening? Pixel phones have always-on song detection (Shazam-like) and usually display song info on the lockscreen within ~10 seconds of the song being played nearby.
That works somewhat similarly to the "Ok Google". Dedicated chip and super small on-device ML model. Nothing goes back to the cloud.
How do you know nothing goes back to the cloud, like metadata?
Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?
#73Earlier quoted context omitted.
> Nothing goes back to the cloud What is your source on this? Every recognizable song is surely not stored on-device so something must be uploaded.
I've tried putting my phone in airplane mode and the feature still works. You can easily try that yourself.
That says the analysis is done locally. It does not say nothing goes to the cloud.
Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?
#74Earlier quoted context omitted.
You have started with a conclusion and filled in the blanks with your personal opinions. And you have not actually answered the question. Which is, "have you actually VERIFIED that popular apps are not recording your conversations?"
"If there was an API for uploading your secret conversations, it would be the holy grail discovery for a security researcher. Someone would have found it."
"That 20 dollar bill lying on the ground in front of me clearly does not exist. Somebody would have picked it up already!"
Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?
#75Earlier quoted context omitted.
> This would get positively lost in the noise of modern smartphone constant background connectivity, no? If you’re only looking at total up/down traffic for the entire device, it might. But we can inspect traffic per-app, including decoding the actual traffic (if you go through steps to circumvent certificate pinning). Security researchers can, and do, look at the actual raw data coming out of apps. If voice was in t…
Average person speaks 16k words per day. Android considers app background traffic excessive at 50MB / hour, which is 1GB / day. 10% of that rate to steer clear of raising red flags is 100MB / day, about 10kB for each word you speak. Rather trivial to steganograph a word in 10kB of background traffic. https://www.scientificamerican.com/article/women-talk-more-t... https://developer.android.com/topic/performance/vitals…
You have to calculate the amount of data provided from all users in this case + storage + processing power to do all of that. It’s probably more than you would expect too.
The second point is why would a company do that? If the NSA or whomever wants to snoop on you, they’ll drop malware on your phone, subpoena your iCloud backups etc. not try to coerce a company to record people’s conversations when said company has no desire to do so.
Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?
#76Earlier quoted context omitted.
It's a mixture of things. The first is "Baader–Meinhof phenomenon" / frequency bias. Your friends talk about X, all of a sudden you notice adverts about X. Of course, you discount the thousands of adverts you see which aren't about X. Why are you and your friends talking about X? Because it's a demographically popular topic. And advertisers have noticed that $gender people of $age_range in $city are searching for X.…
Can all apps access information on the wifi hotspot that a user is connnected to? Seems like an information leak that should be closed by Apple/Google.
The server the app is communicating with can see the IP address of the user, which may be enough to uniquely identify multiple users connected on the same network.
But yes, both iOS[1] and Android[2] have APIs for accessing the name of the connected wifi network. Access depends a bit on how old your OS is and what permissions your app has.
And even if you've locked down permissions for the facebook app, you might have a different app which includes an SDK that slurps up the wifi name, GPS, signal strength of nearby wifi networks, connected cell tower info, and nearby bluetooth devices. That info gets sold to a data broker, which facebook may buy to hit you with an ad for whatever your mate just googled on the other end of the couch.
[1] https://developer.apple.com/forums/thread/679038
[2] https://stackoverflow.com/questions/21391395/get-ssid-when-w...
Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?
#77No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…
> Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers.
For my own learning, I'm interested in this and what methods are used. Do you have any resources (blogs, videos, etc of these security researchers who are looking at these apps) you were thinking about in particular when you wrote this?
Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?
#78Earlier quoted context omitted.
It's a mixture of things. The first is "Baader–Meinhof phenomenon" / frequency bias. Your friends talk about X, all of a sudden you notice adverts about X. Of course, you discount the thousands of adverts you see which aren't about X. Why are you and your friends talking about X? Because it's a demographically popular topic. And advertisers have noticed that $gender people of $age_range in $city are searching for X.…
Can all apps access information on the wifi hotspot that a user is connnected to? Seems like an information leak that should be closed by Apple/Google.
Bob searches for "new Ford car" on Google, Dave is sat next to him in the pub, he opens up his Facebook, and sees an ad for a new Ford car.
The hotspot isn't sharing anything, but the apps are putting data together. Google says "This IP is looking this up, and the tracking matches one of your users" (Or maybe they just firehose searches for relevant terms? I dunno.) Facebook app sees that, then sees that Dave is also using that IP for his Facebook app, put together with a list of Bob/Dave's friends and IP's, it's a high probability that they are talking about it currently, so show Bob's friends nearby that ad.
Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?
#79No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…
I agree that the platforms don't currently allow them default access to microphones, but that's not how it used to be. I also agree that we would have likely heard about this (old) capability, due to the number of people who would have worked on it (unless they were supported by a TLA). However, your description of what it would need to work is woefully naïve. There were startup funded apps that matched entire record…
Shazam was bought by Apple several years ago, but identifying music is a different beast from picking out the phrase Hey Siri/Google/Alexa.
Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?
#80No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…
The coincidences are generally amplified by the fact that apps generally do send location data, when you visit friends you generally talk about stuff you've been looking at lately, so it certainly plausible that linking profiles based on proximity and similarity of interests would mean that there's a much higher chance that advertising interests spread from one user to another, merely by geography.