Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

qz.com

Post reply on HN
Print view View original

131–140 of 149 posts

Re: Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

#131

Post by cronjobber »

tlrobinson wrote: post #98

I, for one, am looking forward to the day Alexa, Siri, Cortana, and Google Now can hold full conversations with each other.

There's an old, old movie about that:

http://www.imdb.com/title/tt0064177

"Forbin is the designer of an incredibly sophisticated computer that will run all of America's nuclear defenses. Shortly after being turned on, it detects the existence of Guardian, the Soviet counterpart, previously unknown to US Planners. Both computers insist that they be linked, and after taking safeguards to preserve confidential material, each side agrees to allow it..."

Re: Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

#132

Post by anantzoid »

imglorp wrote: post #6

Wow, this is a new DDOS attack vector. Get an ad on broadcast radio saying stuff like "alexa, order more milk", or "okay google, send a text to xxxxx".

Google Now takes the user's voice into account during setup and usually responds only to the user's voice. Such a system should have been implemented in Echo too.

Re: Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

#133

Post by KMag »

lsaferite wrote: post #65
gene-h wrote: post #61

Earlier quoted context omitted.

Entertainingly, Alexa supports purchasing music, so one could release a song on Amazon music with audio that triggers Alexa to buy it.

Mine requires a PIN to purchase.

Whom are you fooling? There's a 50/50 chance your PIN is the same as the combination I use on my luggage. And if the PIN is also by voice, a picking a popular PIN will bypass the check for a good fraction of users, particularly if you get 3 tries or something.

Re: Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

#134

Post by raphman »

amelius wrote: post #89
imglorp wrote: post #6

Wow, this is a new DDOS attack vector. Get an ad on broadcast radio saying stuff like "alexa, order more milk", or "okay google, send a text to xxxxx".

The solution is simple: let every user choose a name for their assistant on setup.

:) - https://en.wikipedia.org/wiki/True_name#Folklore

Re: Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

#136

Post by sp332 »

anantzoid wrote: post #132
imglorp wrote: post #6

Wow, this is a new DDOS attack vector. Get an ad on broadcast radio saying stuff like "alexa, order more milk", or "okay google, send a text to xxxxx".

Google Now takes the user's voice into account during setup and usually responds only to the user's voice. Such a system should have been implemented in Echo too.

The Echo is designed to be used by a whole family, and whatever friends you have visiting too (to control music). So that would be counterproductive.

Re: Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

#137

Post by sp332 »

Spivak wrote: post #112
mmanfrin wrote: post #5

Earlier quoted context omitted.

Yes, an internet connected device where you can verbally do a great many things is simply a 'better integrated Clapper'. You sure get it.

Its a cylinder that performs canned transactions in response predefined audible commands. Accurate language processing is a huge technical achievement but let's not elevate this particular use of the technology to more than it is. It's a clapper with more functions. When a device like this can actually understand the commands or queries its given we can call it something more.

If I tell it to play music and it plays music, what more is there to understand? What kind of conversation do you want to have?

Re: Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

#138

Post by sp332 »

dmritard96 wrote: post #123
pbhjpbhj wrote: post #82

Earlier quoted context omitted.

Wouldn't that kill part of the purpose if you had to eyeball the thing to give it voice commands. Better might be to learn the location of audio producing devices (TV, radio, stereo, etc. [it tracks sound origin with multiple mics right?]) and track whether the command came from that direction and use that as a Bayesian factor for whether to trust the voice as being a user?

replay attacks are trivial and probably hard to defend against in the audio space no matter what

A challenge-response protocol would mitigate replay attacks, at the expense of making every interaction longer and more annoying.

Re: Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

#139

Post by sp332 »

nialv7 wrote: post #73

I don't understand why would anyone think having a remote control system without any form of encryption or authentication is a good idea.

You get an email confirmation for every transaction and you can cancel, challenge, or return nearly anything.

Re: Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

#140

Post by sp332 »

vessenes wrote: post #66
imglorp wrote: post #6

Wow, this is a new DDOS attack vector. Get an ad on broadcast radio saying stuff like "alexa, order more milk", or "okay google, send a text to xxxxx".

Children's advertisements did this in the 1980s in the US with pay-per-minute numbers. The ad would offer to connect children to Santa if they held a phone up to the television. DTMF -> 900 number -> profits.

People at NPR were joking later that they should just ask listeners' devices to send them money during a fund drive.
Post reply on HN