Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon to hand over Echo audio from alleged murder after defendant consents

bbc.com

Post reply on HN
Print view View original

171–180 of 196 posts

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#171

Post by CaptSpify »

njharman wrote: post #140
dade_ wrote: post #21

At this point I assume they have a warrant, so I don't understand what the problem is. People should assume their devices can and will be used against them. A much more tricky conversation is when a friend of mine discovered that fragments of his a session with his psychologist recorded by his Android Wear watch.

> people should assume What I assume is that the bill of rights will not be subverted just because I use technology. The right to not be subject to search and right to not self incrimate.

> What I assume is that the bill of rights will not be subverted just because I use technology

Given all of the revelations in the past few years, I'd consider that dangerously naive. Sure, the BoR should settle the argument, but it has notoriously been ignored.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#172

Post by CaptSpify »

graphememes wrote: post #158
skocznymroczny wrote: post #51

Earlier quoted context omitted.

For all you know, it could be recording all the time, and since it's a closed device, you can't prove otherwise.

Actually you can monitor the packets coming through your network and prove whether it is recording or not. Also reverse-engineering the Alexa, and taking it apart will allow you to see whether there is enough storage space for lengthy conversations. Which are only stored for in-transit post the wake-word however. You can delete your recordings on amazon.com and google also allows you to delete your recordings if you…

> So this will give you insight into what recordings they do have.

This will give you insight into what recordings they tell you that they have.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#173

Post by CaptSpify »

rblatz wrote: post #83
heheocoenev wrote: post #26

Seriously, screw google home and Amazon echo. If I wanted a wiretap, I'd go to FISA court.

Odds are you already carry one around with you every where you go.

So we should ignore one attack vector because another one exists? sounds like a pretty poor argument to me.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#174

Post by beojan »

leeoniya wrote: post #156
cperciva wrote: post #153

Earlier quoted context omitted.

You don't need to trust the code on the server -- that's the point. You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.

ah yes, sorry. is there a trusted compilation service that uses a distributed agreement mechanism, à la blockchain or DHT for validating some git/svn hash against a binary. every downloadable source publishes its own binary hashes but the whole practice is somewhat moot in the event of server compromise, not to mention build reproducability.

You can compile the code yourself, then you would know the binary matches the source.

Of course, you have to trust your compiler and OS, but with a service you would have to trust their compiler and OS.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#175

Post by throwaway2016a »

andrepd wrote: post #151
idanoeman wrote: post #148

Earlier quoted context omitted.

How do you know they don't 1. Listen all the time 2. Use a small neural network on the device to detect when a voice is present 3. Collect this data into one zip file, then send the file when the user says "Alexa", or anything remotely close. They could even put a size limit on the data upload to reduce the variance to prevent you from ever testing whether they do this. Or, they could simply transcribe the audio on t…

Yes, exactly this. They could easily just TTS what you are saying, save the text, and send it together with the rest of the info when you say "Alexa". Thus only sending information when you say "Alexa" but managing to upload all your conversations. I would be very surprised if they aren't doing something like this. The power of analysing which products you talk about in your home more often, what kind of stuff you co…

It is very well known that the actually speech processing happens on the cloud. To deploy a whole cloud voice recognition system if you have distributed network with TTS capability on the device would be quite a lot of redundant work to go through.

However, with that said, unless they do certificate pinning on their device the answer to that is to MITM the device and snoop on the traffic.

If they do certificate pinning the answer is:

1. Pre-record an Alexa commend

2. Play back the recording

3. Wait a minute

4. Replay the command

5. Measure the size of the packets going across the network

6. Wait a week while playing something that sounds like natural conversation - say an audio book

7. Replay the command audio file

8. Measure the amount size of data sent between the end of the second command and the end of the last

It should be slightly more than the second command was to account for things like checking for updates. But if it includes the TTS (which is essentially an audio book transcribed at this point) than it would be quite a bit larger even with text compression.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#176

Post by throwaway2016a »

vollmond wrote: post #75
andrepd wrote: post #62

Earlier quoted context omitted.

> The audio Amazon receives is from only-just-barely-before the wakeword up to and through the command or timeout expiration. I wonder, how on earth do you know that, that you are able to dismiss it with such confidence as a non-issue. That's the problem with proprietary systems (proprietary always-on microphones at that). I would be surprised if they weren't actually listening and analysing and storing data from the…

FWIW, I've seen a couple threads on Reddit where people did network sniffing -- the echo only had network traffic after the wakeword. So, in a hearsay/amateur manner, it seems to not be doing that. As someone else mentioned, they could of course record constantly, then compress and transmit in batches, and that would probably go unnoticed.

> As someone else mentioned, they could of course record constantly, then compress and transmit in batches, and that would probably go unnoticed.

Possibly, but it can be fingerprinted by using known audio samples and intentionally producing very large amounts of data. See my other reply.

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#177

Post by treebeard901 »

kbenson wrote: post #122
squarefoot wrote: post #105

Earlier quoted context omitted.

Totally possible. As an example, Codec2 used in ham-radio applications can send pretty decent voice audio at a few kilobit/s or less, and it keeps sounding perfectly understandable even at 1.2 kbit/s like this short sample: http://www.rowetel.com/downloads/codec2/hts1a_1200.wav More information here: http://www.rowetel.com/?page_id=452

To spell it out, that's extremely unlikely, it's not impossible . Just very, very costly.

Easy answer. They may not have to send the audio. They could transcribe it locally at the client, encrypt, and send text to store on the server. Consider that almost a decade ago, programs like dragon naturally speaking could be run on a relatively inexpensive laptop. It's entirely possible that a dedicated device like the echo could do this today. EDIT: Original reply sounded too definitive

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#178

Post by brokenmachine »

ynniv wrote: post #90
seanhunter wrote: post #69

Earlier quoted context omitted.

There are quite a few situations where you have an obligation to not delete data so "legally you've done nothing wrong" is probably overly broad.

Under which circumstances is an individual required to retain data that they created?

Under which circumstances is an individual required to retain data at all?

Re: Amazon to hand over Echo audio from alleged murder after defendant consents

#180

Post by _rpd »

draw_down wrote: post #179

I haven't seen a compelling use case for these things yet, including visiting the homes of people who own one. But I sure have seen a lot of deal-breakers.

I know someone who is smart and reasonably concerned about privacy issues, but she loves the thing - uses it instead of a shopping list. I was quite surprised that she would compromise for such a trivial convenience, but it made me revise the likelihood that they'll be more widely adopted.
Post reply on HN