Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your phone isn't secretly listening to you, but the truth is more disturbing

newatlas.com

Post reply on HN
Print view View original

41–50 of 336 posts

Re: Your phone isn't secretly listening to you, but the truth is more disturbing

#41

Post by grishka »

daveguy wrote: post #39
grishka wrote: post #37

Earlier quoted context omitted.

There is a permission to record the screen. It requires user consent and there's an icon in the status bar while it's being used. It's impossible to use this covertly. What I believe the article is speaking about, is an app taking screenshots of its own windows. This is obviously possible and obviously requires no permissions whatsoever. Just make a screen-sized bitmap and do getWindow().getDecorView().draw(new Canva…

> It's impossible to use this covertly. *Unless there's a zero-day that allows it.

If you're going to exploit a privilege escalation vulnerability from your app, why not just grab the most interesting parts of the /data partition while you're at it?

Re: Your phone isn't secretly listening to you, but the truth is more disturbing

#42

Post by lamp_book »

simonw wrote: post #30
steve_adams_86 wrote: post #12

Earlier quoted context omitted.

Something I discovered when going down this rabbit hole is that if you had that conversation in your house and your visitors have access to your wifi, it may be that they performed the search without you knowing, and your ISP connected that data to you and sold it (as they do).

How would your ISP connect that data if every search engine uses HTTPS now, so there's no way for the ISP to see what you were searching for?

Yeah, it's Google and Facebook - not the ISP.

Re: Your phone isn't secretly listening to you, but the truth is more disturbing

#43

Post by Spivak »

microflash wrote: post #40
wrs wrote: post #4

BTW, "smart" TVs send screenshots too. [0] [0] https://dl.acm.org/doi/10.1145/3646547.3689013

We’ve reached the state where you can safely presume anything “smart” is violating your privacy.

Anything network connected.

Re: Your phone isn't secretly listening to you, but the truth is more disturbing

#44

Post by IggleSniggle »

simonw wrote: post #30
steve_adams_86 wrote: post #12

Earlier quoted context omitted.

Something I discovered when going down this rabbit hole is that if you had that conversation in your house and your visitors have access to your wifi, it may be that they performed the search without you knowing, and your ISP connected that data to you and sold it (as they do).

How would your ISP connect that data if every search engine uses HTTPS now, so there's no way for the ISP to see what you were searching for?

DNS lookups are still frequently in the clear, and even if they're not, that just means you're trusting some DNS-over-HTTPS provider. The incentives are perverse.

And of course whoever you are performing your search with, like, oh, an ad company like Google, Meta, or Facebook? They just might use that search data for something.

Re: Your phone isn't secretly listening to you, but the truth is more disturbing

#45

Post by gretch »

o11c wrote: post #27
wiseowise wrote: post #10

> There is no easy way to close this privacy opening Sure there is. Hide screenshot taking behind permission and slap down hard apps that refuse to operate without them.

It says "screenshots of themselves". The application is responsible for rendering the screen in the first place so it fundamentally doesn't need a permission. Now, what could reasonably be a permission is "access the internet", but our overlords don't approve of that thought. (Contrast this to web pages, which do not render themselves and thus can sensibly be blocked from screenshotting)

I mean yeah technically the website can’t screenshot, but it can do many functionally equivalent things.

For example, it can capture the entire DOM and send it off, including the contents of input fields that have not been submitted.

That DOM capture can be replayed on a browser to show what the user sees. So what’s the difference?

Re: Your phone isn't secretly listening to you, but the truth is more disturbing

#46

Post by simonw »

daveguy wrote: post #39
grishka wrote: post #37

Earlier quoted context omitted.

There is a permission to record the screen. It requires user consent and there's an icon in the status bar while it's being used. It's impossible to use this covertly. What I believe the article is speaking about, is an app taking screenshots of its own windows. This is obviously possible and obviously requires no permissions whatsoever. Just make a screen-sized bitmap and do getWindow().getDecorView().draw(new Canva…

> It's impossible to use this covertly. *Unless there's a zero-day that allows it.

Burning a zero-day like that for targeted advertising seems extremely unlikely to me.

Re: Your phone isn't secretly listening to you, but the truth is more disturbing

#47

Post by simonw »

IggleSniggle wrote: post #44
simonw wrote: post #30

Earlier quoted context omitted.

How would your ISP connect that data if every search engine uses HTTPS now, so there's no way for the ISP to see what you were searching for?

DNS lookups are still frequently in the clear, and even if they're not, that just means you're trusting some DNS-over-HTTPS provider. The incentives are perverse. And of course whoever you are performing your search with, like, oh, an ad company like Google, Meta, or Facebook? They just might use that search data for something.

Exactly. Google or Meta can correlate behavioral data like this. Your ISP cannot do that by intercepting your searches.

I care about accuracy when it comes to privacy conversations. I don't want people wasting their time on theories that aren't true when they should be focusing on the real issues at stake.

Re: Your phone isn't secretly listening to you, but the truth is more disturbing

#48

Post by sadeshmukh »

Ferret7446 wrote: post #29
alganet wrote: post #14

There's a nation proud of overspinning enrichment turbines with a complicated computer virus that can even work offline. No conspiracy, that's just StuxNet. So, when you start learning about tech, you get paranoid. If you're not, it's even weirder. The fact that someone can target you, individually, is undisputable. Whether it will or not, that's another question. What I can recommend if you think you are being obser…

Sounds like the age old adage: if it's too good to be true, it is.

If it sounds too good to be true, it probably is. Otherwise it's just a tautology.

Re: Your phone isn't secretly listening to you, but the truth is more disturbing

#49

Post by Supermancho »

Am4TIfIsER0ppos wrote: post #11

I seem to recall that state of the art audio encoding can compress voice to 8kbit/s which is a single packet per second, insignificant compared to how chatty your device is. Trivial to buffer and send during a period of activity. It sums to 1.7MB over the 30 minute window in the article graphs which should be visible if it is actually counted. Why would apple or google actually make it count though? They want to spy…

Knowing how digital advertising works, it's more likely that a payload is delivered to the phone in some app or by os or by browser that has a dictionary of keywords paid for to be associated with specific ad campaigns. If the device detects that term (via sound, search, or media) it triggers a message home as an analytics to target you and your device now calls for those campaigns.

Re: Your phone isn't secretly listening to you, but the truth is more disturbing

#50

Post by Supermancho »

simonw wrote: post #36
Narkov wrote: post #33

Earlier quoted context omitted.

What makes you think the raw audio stream needs to be sent anywhere. Modern phones are capable of doing keyword extraction on-device.

This conspiracy theory has been around for a lot longer than phone hardware has been capable of doing that.

The Chrome Browser can transcribe audio into text, with what I consider good accuracy. It's well out of the realm of a conspiracy theory when it's been demonstrable for a couple decades.
Post reply on HN