Your phone is listening and it's not paranoia (2018)

Ha, I remember Warheads! Those were good.

Yeah, I've had one of those happen to me where it was just uncanny if it wasn't listening. I walked into work and my coworker was sitting there working and asked how I was. As I put down my stuff and was taking my lunch out of my backpack I was like, "I'm good, but my backpack zipper just broke!"

When I logged into facebook ~30 minutes later I had ads for backpack zippers. It was downright unsettling and I actually deleted facebook app from my phone over it. I still remember that unnerving feeling in the pit of my stomach when I saw the ad, as I never got any ads like that previously. I definitely was one of those people who thought the "your phone is listening" stuff was paranoia, but that made me at least reconsider if not agree.

This article doesn’t make any sense.

> For your smartphone to actually pay attention and record your conversation, there needs to be a trigger, such as when you say “hey Siri” or “okay Google.” In the absence of these triggers, any data you provide is only processed within your own phone. This might not seem a cause for alarm, but any third party applications you have on your phone—like Facebook for example—still have access to this “non-triggered” data. And whether or not they use this data is really up to them.

> “From time to time, snippets of audio do go back to [other apps like Facebook’s] servers but there’s no official understanding what the triggers for that are,” explains Peter. “Whether it’s timing or location-based or usage of certain functions, [apps] are certainly pulling those microphone permissions and using those periodically. All the internals of the applications send this data in encrypted form, so it’s very difficult to define the exact trigger.”

Now, I don’t know much about Android, but I do know how it works on iOS: the “Hey Siri” trigger is run by a specialized “always on” coprocessor that is designed to only detect the trigger word, and when it does it will power on the rest of the device to continue responding to the request. Until that happens your phone is pretty much entirely off: the AP isn’t powered. You can’t just “add a trigger” to listen to.

Plus, even if apps could somehow add triggers, or abuse background execution to do their own detection, you’d be able to see it. Bluntly: if you’re actually a “senior security consultant”, you need to do better than throw up your arms and go “boo hoo it’s encrypted who knows what is going on”. Reverse engineer the apps and find it…

"any third party applications you have on your phone—like Facebook for example—still have access to this “non-triggered” data"

Source? (I know it's three years old.) The piece offers nothing to back this up, and I have trouble believing it. What OSes allow apps to access audio data that _didn't_ trigger the assistant?

So I do agree that if someone found out how to subvert iOS and Android’s sandboxing and also figured out a way to block the OS from showing the icon that your mic is on, that FB or Google would guard the secret with their lives. But to assume they found it, and have kept it secret this long, and no one else has found any theoretical evidence it is possible… that’s too many highly improbable things to believe without just a hint of non-anecdote evidence. Law of large numbers (you talk about a lot of things, you see a lot of ads, there are a lot of people) says tons of these stories are real, but complete coincidence.

Or you get hundreds of ads every day and pay no attention to them at all unless they coincidentally correspond to something you were thinking about recently.