Ask HN: Is anyone monitoring popular apps to check if they're listening? • Hacker News Board

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#81

Post by fragmede » Sun, Sep 19, 2021, 4:38 PM UTC

znpy wrote: post #28

PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

> Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth I'm skeptical regarding bandwidth. Modern codecs can achieve spectacular compression, you don't necessarily need to record audio-cd-level quality audio, and Facebook has state of the art hardware and software in terms of ai/ml and a very well trained workforce in the field. If anything, one should regard Facebook a…

That's assuming the audio gets uploaded. For the purposes of serving more relevant ads, simple hotword detection need only be good enough to distinguish eg Nike vs Adidas, and could be done locally. That changes the upload to mere bytes, which is way more easily obfuscated in any number of opaque IDs. fbclid= anyone?

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#82

Post by fragmede » Sun, Sep 19, 2021, 4:41 PM UTC

polote wrote: post #55

max_ wrote: post #43

Earlier quoted context omitted.

You have started with a conclusion and filled in the blanks with your personal opinions. And you have not actually answered the question. Which is, "have you actually VERIFIED that popular apps are not recording your conversations?"

"If there was an API for uploading your secret conversations, it would be the holy grail discovery for a security researcher. Someone would have found it."

Yeah the logic here is seriously lacking. Heartbleed shows that it's entirely possible someone might not find it for over a decade! Or the most recent Apple Bootrom exploit.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#83

Post by abnry » Sun, Sep 19, 2021, 4:46 PM UTC

PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

> The myth persists because coincidences will happen in high numbers at scale.

I think the myth persists because Big Tech can learn more about you from browsing history and credit card purchases (from you and your friends and family) than most people realize.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#84

Post by abnry » Sun, Sep 19, 2021, 4:50 PM UTC

Terretta wrote: post #69

ignoramous wrote: post #61

Earlier quoted context omitted.

The advertisements I see online or in email spam happen to coincide with whatever I had just been discussing with my mates. This has been the case for a good part of three years. May be its the Baader–Meinhof phenomenon as someone else in this thread points out, but the ads I see, at the time I see, make me quite uneasy knowing what I know being in tech. Edward Snowden, famously, rids of the entire microphone-array f…

The simplest explanation of this is that there’s an antecedent reason you’re discussing what you’re discussing, and that’s the reason that correlates to the ads you see, rather than your discussion itself. Perhaps it’s content you read. Perhaps it’s another product you researched. Perhaps it’s something someone in your office or home looked for from the same IP. Perhaps another ad campaign triggered the discussion. T…

IMO this is the real story. Tech companies know so much about you from your browsing history and your purchase history. But they also know this about your friends and family, which I think increases the creepiness factor, as they may serve you ads based on _your friends & family's_ activity.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#85

Post by linkandzelda » Sun, Sep 19, 2021, 5:08 PM UTC

PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

I've had at least 10 situations where Facebook or YouTube recommend me an ad or video based on a real-life conversation which took place around 1 minute before.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#86

Post by b3morales » Sun, Sep 19, 2021, 5:23 PM UTC

dylan604 wrote: post #47

PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

>Recording and interpreting speech would require a lot of CPU (if done on device) Does this include the newer Apple Axx series units with increasing number of ML cores? Siri is supposed to run locally on device. Hardware is moving explicitly in this direction. If this is done locally, no actual voice data would need to be sent down the wire. Insstead, a small compressed bit of text on keywords could be sent whether t…

> increasing number of ML cores? Siri is supposed to run locally on device. ... If this is done locally, no actual voice data would need to be sent down the wire.

Surreptitiously taking advantage of what you describe would be restricted to Apple, which is its own concern but a different topic than what we started with, which is 3rd-party apps.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#87

Post by jb0x168 » Sun, Sep 19, 2021, 5:25 PM UTC

fragmede wrote: post #82

polote wrote: post #55

Earlier quoted context omitted.

"If there was an API for uploading your secret conversations, it would be the holy grail discovery for a security researcher. Someone would have found it."

Yeah the logic here is seriously lacking. Heartbleed shows that it's entirely possible someone might not find it for over a decade! Or the most recent Apple Bootrom exploit.

Or, y'know, the NSO group exploit.

I think the difference here is that apps getting uploaded to the app store have static analysis run on them looking for unauthorized calls. Still doesn't rule it out, but adds an extra check to the process.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#88

Post by tompazourek » Sun, Sep 19, 2021, 6:18 PM UTC

giansegato wrote: post #26

PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

It's not only a matter of "big numbers", but also of confirmation bias. We're never paying any attention to irrelevant ads - we're ad blind to them. But the moment we see a very relevant ad to a recent conversation, that will inevitably pop up. "See, this one ad is tied to this conversation I had yesterday: they must be listening", while in reality it's more like "See, this one ad out of 100s I've seen in the last da…

I also have one more theory which is that this effect can be caused by the network aspect of Facebook. Maybe I haven't been interested in a specific topic, but one of my friends was. And Facebook is serving me ads because they were relevant for my friends so they might be relevant to me. And the conversations where I heard about a topic are a consequence of that same thing -- one of my friends is interested in a certain topic.

I don't know how valid it is though. But it could contribute to the whole thing I guess...

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#89

Post by tompazourek » Sun, Sep 19, 2021, 6:21 PM UTC

sva_ wrote: post #32

PragmaticPulp wrote: post #6

No, Facebook and Instagram are not monitoring conversations. Yes, many security researchers routinely examine traffic from these apps to see what’s being communicated with the servers. Recording and interpreting speech would require a lot of CPU (if done on device) or network bandwidth (if uploaded to the cloud). Enough that it would be immediately obvious if apps were trying to do this. That is, if they even could.…

> some number of them will see ads related to some conversation they had recently by pure random chance. Or perhaps, they're just correlating the interests of people: 1. Person A reads about X online 2. Person A tells Person B about X 3. Person B sees ads about X, without ever having searched for it, concludes they're being spied on I'm 99.9% sure WhatsApp does this, perhaps illegally or at least grey-area.

Maybe WhatsApp knows that these 2 people are friends, so it tries to serve person B ads that worked for person A.

Re: Ask HN: Is anyone monitoring popular apps to check if they're listening?

#90

Post by TeMPOraL » Sun, Sep 19, 2021, 6:42 PM UTC

kempbellt wrote: post #58

angelzen wrote: post #39

Earlier quoted context omitted.

The hardware runs an algorithm to detect the wakeword. What makes you confident that a different algorithm can't be run to translate voice to text? They will be in the same family of algorithms, just with different purposes. To make it more interesting, let's assume that 2021 algorithms can't do that. Will better low power algorithms be developed in the next 20 years? How is a democratic society supposed to work when…

When you train your phone to understand "Hey Siri" it requires an internet connection for the training so that it can verify that you are actually saying, "Hey Siri" and not "Yo, phone spirit". After the initial training, it no longer requires (or uses) the internet to detect the keyphrase. You are asked to do a few iterations of training so that the phone has a model on your voiceprint for "Hey Siri". Which is why,…

This explanation does not explain why neither Google nor Apple allow you to change the wake word.

Myself, I believe any technical reason, if it actually exists, is a secondary factor - the primary reason is branding. They don't want people changing wakewords, because as long as everyone uses the same, "Ok Google" and "Siri" are terms/brands.