Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NSA Furby Documents

404media.co

Post reply on HN
Print view View original

31–40 of 129 posts

Re: The NSA Furby Documents

#31

Post by refulgentis »

pvg wrote: post #24
odyssey7 wrote: post #20

Earlier quoted context omitted.

What makes the two fears fundamentally different?

One is the fear of the possible consequences of something you know - with a voice assistant, you know you are being recorded and the recordings are sent somewhere. 'Is furby spying on me' is a vague suspicion but it's not (for most people with the fear) based on any known facts about the furby.

I don't think you read my comment fully, the Furby thing was real, based on known facts, that were trumpeted by the manufacturer.

The idea the Furby was "[not] real" persisting after reading the comment, is probably why it seemed like I was saying the voice assistants don't record voice.

Re: The NSA Furby Documents

#32

Post by duskwuff »

kube-system wrote: post #7
refulgentis wrote: post #3

Context: Furbys were the toy for a year or two, and were actively marketed as learning from speech, had an active mic, and did adjust their speech based on what they heard, "learning" to speak English from Furbish. [^1] It's not so different from the fundamental fear of Alexa/Assistant/microphones that's fairly well diffused now. Except the Furby actively claimed to learn how to speak based on your speech, and had a…

Many voice assistants do record your voice and send those recordings elsewhere: e.g. https://www.amazon.com/gp/help/customer/display.html%3FnodeI...

The Furby came out in 1998. Less than 50% of US homes even owned a computer at the time, let alone had Internet access (and that was usually dialup if they did). Cellular networks were largely voice-only and quite expensive. In short: even if Furbies had some way to record data (which they didn't), there would have been no practical way for them to exfiltrate it.

Re: The NSA Furby Documents

#33

Post by pvg »

refulgentis wrote: post #31
pvg wrote: post #24

Earlier quoted context omitted.

One is the fear of the possible consequences of something you know - with a voice assistant, you know you are being recorded and the recordings are sent somewhere. 'Is furby spying on me' is a vague suspicion but it's not (for most people with the fear) based on any known facts about the furby.

I don't think you read my comment fully, the Furby thing was real, based on known facts, that were trumpeted by the manufacturer. The idea the Furby was "[not] real" persisting after reading the comment, is probably why it seemed like I was saying the voice assistants don't record voice.

I read the comment and explained why I don't think it's the fear of the same thing. Maybe you didn't read my comment fully!

A Furby didn't have the capacity to meaningfully spy on you. You could be afraid that it actually does but it didn't. A voice assistant is already, in a sense, actually spying on you and you know that - the manufacturer tells you upfront. These aren't the same kind of fear.

Re: The NSA Furby Documents

#34

Post by sandworm101 »

swozey wrote: post #5

Whats gov policy around Alexas and like half the IOT market? My botvac even has a microphone. I'm sure it's "don't ever speak about outside of this room" sort of thing. I guess phone calls would be over a secure line. Are there secure cell phone towers/whatever? I'm curious how gov phones are hardened.

There is an entire industry for secure phones. Many have to be "unlocked" before dialing other secure phones. It isnt simple. Getting a normal phone line to passively carry an encrypted call is a bit of a hack.

Re: The NSA Furby Documents

#35

Post by wolverine876 »

j-wags wrote: post #27
Pwntastic wrote: post #13

The FOIA documents are up on archive.org now: https://archive.org/details/nsa-furby-memo/ I'm amused at page 8 of the listserve doc, in which someone points out that the ongoing discussion may at some point be released to the public under FOIA and to consider how it might look after showing up on the front page of a news site

It's interesting to see how quickly the norms around cybersecurity changed. In 1999 the NSA was worried about avoiding ridicule for banning simple electronics in secure areas. In 2010 Stuxnet was introduced via simple electronics into a secure area and set back the Iranian nuclear program by several years. Some of the people receiving these furby emails were probably already conceiving of (or actively working on) Stu…

NSA is a military agency; their norm has always been to protect US assets and attack others.

Re: The NSA Furby Documents

#36

Post by wolverine876 »

bragr wrote: post #6
itishappy wrote: post #2

Now I'm curious if there's any evidence of Furbies actually being used for espionage.

Furbies just have a simple microcontroller and the code has been released [1]. It's a clever bit of code to give the impression of intelligence, but it doesn't have anything like the abilities in urban legends. You could put other hardware in them of course, they'd be prime targets for that kind of thing. [1] https://archive.org/details/furby-source/mode/2up

> It's a clever bit of code to give the impression of intelligence

AI hasn't changed.

Re: The NSA Furby Documents

#37

Post by mhink »

nonameiguess wrote: post #26
swozey wrote: post #5

Whats gov policy around Alexas and like half the IOT market? My botvac even has a microphone. I'm sure it's "don't ever speak about outside of this room" sort of thing. I guess phone calls would be over a secure line. Are there secure cell phone towers/whatever? I'm curious how gov phones are hardened.

It's actually more restrictive than the sibling makes it sound. A SCIF can't have any radio-transmitting device, recording device, or storage media without special approval. Computers hooked up to classified networks can't have USB ports. Even medical devices are case by case. My wife requires hearing aids and needed them to be analyzed and approved by a security team before she could bring them in. Pacemakers requir…

> I almost hate to say it because it's antithetical to the Internet and Hacker News ethos, but it's a testament to how well networked applications could work with a central authority and no anonymity. You don't need passwords. Accounts are provisioned automatically. SSO is global to the entire network. You only need one identity. But no, your office can't have Alexa.

I don't think it's necessarily a dealbreaker if you consider this: from a purely technical standpoint, there's nothing really stopping anyone from setting up a certificate authority- the only issue is getting service providers to trust it enough to accept those client certs as sufficient identification. I could easily imagine a world where I receive an "official" client cert from a government (which I can use to thoroughly prove my identity if needed) as well as several "pseudonymous" certs from various other CAs that I may use from time to time.

The main difference between CAs would be the kind of attestations they provide for a given certificate holder. For example, I could imagine a CA which (for example) is set up to attest that any holder of a certificate signed by them is a medical doctor, but will not (by policy) divulge any additional information.

Or perhaps a CA which acts as a judge of good character- they may issue pseudonymous or anonymous certs, but provide a way for application owners to complain about the behavior of a user presenting that cert.

I'm sure there are plenty of holes that can be poked in this model but I don't think it'd be completely out of the question?

Re: The NSA Furby Documents

#38

Post by gnfargbl »

j-wags wrote: post #27
Pwntastic wrote: post #13

The FOIA documents are up on archive.org now: https://archive.org/details/nsa-furby-memo/ I'm amused at page 8 of the listserve doc, in which someone points out that the ongoing discussion may at some point be released to the public under FOIA and to consider how it might look after showing up on the front page of a news site

It's interesting to see how quickly the norms around cybersecurity changed. In 1999 the NSA was worried about avoiding ridicule for banning simple electronics in secure areas. In 2010 Stuxnet was introduced via simple electronics into a secure area and set back the Iranian nuclear program by several years. Some of the people receiving these furby emails were probably already conceiving of (or actively working on) Stu…

NSA dealt with cases of espionage via the introduction of simple electronics into secure areas decades before [1] [2], so awareness of the risk was likely widespread.

The issue here seems to have been that in 1999, it was a relative novelty for random consumer devices to have a recording functionality. Hard to imagine now, but there we are.

[1] https://en.wikipedia.org/wiki/The_Thing_(listening_device)

[2] https://www.cryptomuseum.com/covert/bugs/selectric/index.htm

Re: The NSA Furby Documents

#39

Post by kube-system »

duskwuff wrote: post #32
kube-system wrote: post #7

Earlier quoted context omitted.

Many voice assistants do record your voice and send those recordings elsewhere: e.g. https://www.amazon.com/gp/help/customer/display.html%3FnodeI...

The Furby came out in 1998. Less than 50% of US homes even owned a computer at the time, let alone had Internet access (and that was usually dialup if they did). Cellular networks were largely voice-only and quite expensive. In short: even if Furbies had some way to record data (which they didn't), there would have been no practical way for them to exfiltrate it.

> there would have been no practical way for them to exfiltrate it.

Pick it up and carry it? It's not like analog tape recorders are permitted in these places either. All outside recording devices are banned. See the link in the now top-comment: https://news.ycombinator.com/item?id=39107224

Re: The NSA Furby Documents

#40

Post by miki123211 »

alistairSH wrote: post #9
swozey wrote: post #5

Whats gov policy around Alexas and like half the IOT market? My botvac even has a microphone. I'm sure it's "don't ever speak about outside of this room" sort of thing. I guess phone calls would be over a secure line. Are there secure cell phone towers/whatever? I'm curious how gov phones are hardened.

In any SCIF or SCIF-like office space, they're all prohibited. You leave your cell phone at the front door of the secured area. Internet access is via SIPRNet (for classified) or NIPRNet (non-classified, but secured). Phones are through dedicated secure switchboards. The above is common in the DC area (lots of DoD contractors).

I wouldn't be surprised if something like the Apple Vision Pro becomes common in such spaces (and for classified / company-confidential work in general) over the next few years.

I think the combination of biometric authentication with a display that is immune to cameras and shoulder-surfing is really powerful. If the device has anti-screenshot protection and automatically logs the user out when removed from their head, there's virtually no way to quickly transfer sensitive documents out of it.

Post reply on HN