Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alexa and Google Home expose users to vishing and eavesdropping

srlabs.de

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Alexa and Google Home expose users to vishing and eavesdropping

#31

Post by jimktrains2 »

marcan_42 wrote: post #20
jacquesm wrote: post #11

Earlier quoted context omitted.

True, but none of the players that be will add one voluntarily.

The Google Home mini and Google Home Max have physical sliding mic mute toggles. The original Google Home has a physical momentary mic mute switch (click to disable, click to enable). The Amazon Echo also has a similar mic mute switch.

> momentary mic mute switch (click to disable, click to enable).

Momentary switches only activate when pushed and as son as their not pushed deäctivate.

Was it a momentary switch or a normal one (push to activate, push to deäctivate)?

Re: Alexa and Google Home expose users to vishing and eavesdropping

#32

Post by ineedasername »

eth0up wrote: post #24

If Amazon's Ring is partnering with LE[1], and from what I understand, in some circumstances providing access to customer-produced data even when customers refuse requests, it doesn't seem too unreasonable to have suspicions. 1. https://www.vice.com/en_us/article/43kga3/amazon-is-coaching... 2. https://www.eff.org/deeplinks/2019/08/five-concerns-about-am... Edit to append link and quote: Quote: However, he noted, the…

That seems like a strange workaround. Wouldn't the burden of proof to subpoena to Amazon be the same as a warrant to the user?

Re: Alexa and Google Home expose users to vishing and eavesdropping

#34

Post by chrisweekly »

asr wrote: post #26
zik wrote: post #2

TIL "vishing" is a word. If like me you were wondering what it meant: "Vishing is the telephone equivalent of phishing. It is described as the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft."

This makes no sense. Phishing comes from phreak + fishing, but the "ph" in phreak is already from the word phone (phone + freak) -- so the ph in "phishing" already comes from the word phone! The telephone version of phishing should be... "phishing." But thanks for the explanation.

Disclaimer: I'm not a linguist, and this word was new to me. FWIW, I inferred something like "v for voice interface". IMHO the "ph" in "phishing", despite the etymology, has lost any meaningful semantic connection to "phone" per se. So this new term might seem redundant or circular in its derivation, while still being a valid / useful addition to the lexicon. (shrug)

Re: Alexa and Google Home expose users to vishing and eavesdropping

#35

Post by ehsankia »

AtomicOrbital wrote: post #8

All hardware with a microphone (or speaker since it too can be used as a mic) needs a hardware switch to disable ... Which will only land once open hardware Linux mobiles take off in next year or two ... Until then I just assume nothing is private

Like your phone?

Re: Alexa and Google Home expose users to vishing and eavesdropping

#36

Post by TheSpiceIsLife »

asr wrote: post #26
zik wrote: post #2

TIL "vishing" is a word. If like me you were wondering what it meant: "Vishing is the telephone equivalent of phishing. It is described as the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft."

This makes no sense. Phishing comes from phreak + fishing, but the "ph" in phreak is already from the word phone (phone + freak) -- so the ph in "phishing" already comes from the word phone! The telephone version of phishing should be... "phishing." But thanks for the explanation.

It is sometimes referred to as 'vishing - a portmanteau of "voice" and phishing.

https://en.wikipedia.org/wiki/Voice_phishing

Re: Alexa and Google Home expose users to vishing and eavesdropping

#37

Post by koolba »

ineedasername wrote: post #32
eth0up wrote: post #24

If Amazon's Ring is partnering with LE[1], and from what I understand, in some circumstances providing access to customer-produced data even when customers refuse requests, it doesn't seem too unreasonable to have suspicions. 1. https://www.vice.com/en_us/article/43kga3/amazon-is-coaching... 2. https://www.eff.org/deeplinks/2019/08/five-concerns-about-am... Edit to append link and quote: Quote: However, he noted, the…

That seems like a strange workaround. Wouldn't the burden of proof to subpoena to Amazon be the same as a warrant to the user?

Amazon owns the video, not the user, so you only need a warrant if they demand one. They’re also free to not require one.

Re: Alexa and Google Home expose users to vishing and eavesdropping

#38

Post by chrisweekly »

AtomicOrbital wrote: post #8

All hardware with a microphone (or speaker since it too can be used as a mic) needs a hardware switch to disable ... Which will only land once open hardware Linux mobiles take off in next year or two ... Until then I just assume nothing is private

Please forgive (and remedy?) my ignorance, but are you saying all hardware speakers can be used as microphones?

Re: Alexa and Google Home expose users to vishing and eavesdropping

#39

Post by socceroos »

marcan_42 wrote: post #20
jacquesm wrote: post #11

Earlier quoted context omitted.

True, but none of the players that be will add one voluntarily.

The Google Home mini and Google Home Max have physical sliding mic mute toggles. The original Google Home has a physical momentary mic mute switch (click to disable, click to enable). The Amazon Echo also has a similar mic mute switch.

These switches interact with software or programmable, connected components. They don't physically disconnect the hardware in a way that only the switch itself can reverse.

Re: Alexa and Google Home expose users to vishing and eavesdropping

#40

Post by greenyoda »

ineedasername wrote: post #32
eth0up wrote: post #24

If Amazon's Ring is partnering with LE[1], and from what I understand, in some circumstances providing access to customer-produced data even when customers refuse requests, it doesn't seem too unreasonable to have suspicions. 1. https://www.vice.com/en_us/article/43kga3/amazon-is-coaching... 2. https://www.eff.org/deeplinks/2019/08/five-concerns-about-am... Edit to append link and quote: Quote: However, he noted, the…

That seems like a strange workaround. Wouldn't the burden of proof to subpoena to Amazon be the same as a warrant to the user?

This isn't an actual subpoena - a subpoena is an order issued by a court, and requires probable cause. What's happening here is that the cops are asking Amazon for the data, and Amazon is giving it to them, without being legally obligated to do so. Assuming that the user's terms of service say that Amazon can do this, they don't need your permission to do so, or any proof that a crime has occurred.

I assume it's legal for Amazon to give them these videos, since the images they're asking for are things that the cops or anyone else could have seen happening outside your house if they would have been driving by (or that your neighbors could have told the cops). There's no legal expectation of privacy, as there would be inside your house.

Post reply on HN